Applying mobile agents technology to intrusion detection and response

Abstract

As the capabilities of intrusion detection systems (IDSs) advance, attackers may disable organizationsa?? IDSs before attempting to penetrate more valuable targets. To counter this threat, we present an IDS architecture that is resistant to flooding denial of service (DoS) attacks. The architecture frustrates attackers by making IDS components invisible to attackersa?? normal means of a??seeinga?? in a network. Upon a successful attack, the architecture allows IDS components to relocate from attacked hosts to operational hosts thereby mitigating the attack. These capabilities are obtained by using mobile agent technology, utilizing network topology features, and by restricting the communication allowed between different types of IDS components.