Anomaly Detection in Network Traffic using Distributed Self-Organizing Multi Agent Systems

Document Type : Original Article

Authors

1 Computer Engineering, Shahid Rajaee Teacher Training University

2 Department of Computer Engineering, Shahid Rajaee Teacher Training University,

Abstract

Challenges in the field of information and communication security are of great interest to researchers. The expansion of network boundaries, the intensification and complexity increase of network security attacks, has amplified the need for intelligent, automated and real-time systems to detect network anomalies and threats. To detect anomalies, network traffic needs to be monitored immediately. The anomaly involves significant and unusual changes in network traffic behavior compared to its normal behavior patterns. In this paper, in order to detect anomalies, a system based on self-organizing multi agent systems is presented. Multi agent systems are made up of agents that interact with each other to achieve a specific goal. These systems are used to solve problems that are difficult for a single agent to solve or integrate. The proposed system architecture is scalable and can adapt to changes in today's networks. The evaluation and analysis of the proposed system in the NSL-KDD dataset shows that the rate of anomalies detection has improved compared to the recently proposed methods. Also, by proposing an algorithm to optimize the agents’ choices and another one for intelligent agents’ decision weighting, the rate of anomaly detection is increased and the time of event analysis is reduced.

Keywords

References

[1] Fernandes, J.J. Rodrigues, L.F. Carvalho, J.F. Al-Muhtadi and M.L. Proença, “A comprehensive survey on network anomaly detection”, Telecommunication Systems, vol. 70, no. 3, pp. 447-489, 2019.
[2] Nisioti, A. Mylonas, P.D. Yoo and V. Katos, “From intrusion detection to attacker attribution: A comprehensive survey of unsupervised methods”, IEEE Communications Surveys & Tutorials, vol. 20, no. 4, pp. 3369-3388, 2018.
[3] H. Bhuyan, D.K. Bhattacharyya and J.K. Kalita, “Network anomaly detection: methods, systems and tools”, IEEE communications surveys & tutorials, vol. 16, no. 1, pp. 303-336, 2013.
[4] Kendrick, N. Criado, A. Hussain and M. Randles, “A self-organising multi-agent system for decentralised forensic investigations”, Expert Systems with Applications, vol. 102, pp. 12-26, 2018.
[5] Rothamsted, T. Lewis and V. Barnett, Outliers in statistical data, John Wiley & Sons, 1996.
[6] Hoque, M.H. Bhuyan, R.C. Baishya, D.K. Bhattacharyya and J.K. Kalita, “Network attacks: Taxonomy, tools and systems”, Journal of Network and Computer Applications,vol. 40, pp. 307-324, 2014.
[7] 2020 Cyber Security Statistics The Ultimate List Of Stats, Data & Trends, June 2020, https://purplesec.us/resources/cyber-security-statistics.
[8] Wooldridge, an Introduction to MultiAgent Systems. Second ed., John wiley & sons, 2009.
[9] Shakarian, G.I. Simari, G. Moores and S. Parsons, “Cyber attribution: An argumentation-based approach”, Cyber Warfare, Springer, pp. 151-171, 2015.
D. McKinnon, S.R. Thompson, R.A. Doroshchuk, G.A. Fink and E.W. Fulp, “Bio-inspired cyber security for smart grid deployments”, IEEE PES Innovative Smart Grid Technologies Conference (ISGT), pp. 1-6, 2013.
Jahanbin, A. Ghafarian, S.A. Hosseini Seno and S. Nikookar, “A computer forensics approach based on autonomous intelligent multi-agent system”, International Journal of Database Theory and Application, vol. 6, no.5, pp. 1-12, 2013.
Shanmugasundaram, N. Memon, A. Savant and H. Bronnimann, “ForNet: A distributed forensics network” International Workshop on Mathematical Methods, Models, and Architectures for Computer Network Security, Springer, 2003.
A. Baig, “Multi-agent systems for protecting critical infrastructures: A survey”, Journal of Network and Computer Applications, vol. 35, no. 3, pp. 1151-1161, 2012.
Kesavamoorthy and K.R. Soundar, “Swarm intelligence based autonomous DDoS attack detection and defense using multi agent system”, Cluster Computing, vol. 22, no. 4, pp. 9469-9476, 2019.
Mees, “Multi-agent anomaly-based APT detection”, Proceedings of Information Systems Technology Panel Symposium, 2012.
آمره­ای، بیگی، «یک سیستم تشخیص نفوذ چندلایه با رویکرد ترکیبی»، پانزدهمین کنفرانس بین‌المللی انجمن رمز ایران، تهران، انجمن رمز ایران, 1397.
Distributed Self-organizing Multi-agent System, July 2020, https://gitlab.com/N_shakiba/dsms/
NSL-KDD dataset, June 2020, https://www.unb.ca/cic/datasets/nsl.html.
Hall, E. Frank, G. Holmes, B. Pfahringer, P. Reutemann and I.H. Witten, “The WEKA data mining software: an update”, ACM SIGKDD explorations newsletter, vol. 11, no. 1, pp. 10-18, 2009.
Yin, Y. Zhu, J. Fei and X. He, “A deep learning approach for intrusion detection using recurrent neural networks” IEEE Access, vol. 5, pp. 21954-21961, 2017.
A.R. Ashfaq, X.Z. Wang, J.Z. Huang, H. Abbas and Y.L. He, “Fuzziness based semi-supervised learning approach for intrusion detection system”, Information Sciences, vol. 378, pp. 484-497, 2017.
Su, H. Sun, J. Zhu, S. Wang and Y. Li, “BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset”. IEEE Access,vol. 8, pp. 29575-29585, 2020
Gao, Y. Liu, Y. Jin, J. Chen, and H. Wu, “A novel semi-supervised learning approach for network intrusion detection on cloud-based robotic system”, IEEE Access, vol. 6, pp. 50927-50938, 2018.
Naseer, Y. Saleem, S. Khalid, M.K. Bashir, J. Han, M.M. Iqbal and K. Han, “Enhanced network anomaly detection based on deep neural networks”. IEEE Access. Vol 6, pp. 48231- 48246, 2018.
A. Tama, M. Comuzzi and K.H. Rhee, “TSE-IDS: A two-stage classifier ensemble for intelligent anomaly-based intrusion detection system”. IEEE Access, vol. 7, pp. 94497-507, 2019.
Illy, G. Kaddoum, C.M. Moreira, K. Kaur and S. Garg, “Securing fog-to-things environment using intrusion detection system based on ensemble learning”. IEEE Wireless Communications and Networking Conference (WCNC), pp. 1-7, 2019.
Alsubhi, N. Bouabdallah and R. Boutaba, “Performance analysis in intrusion detection and prevention systems”, IFIP/IEEE International Symposium on Integrated Network Management (IM 2011) and Workshops, 2011.

Files

Share

How to cite

Statistics