A Snort-based agent for a JADE multi-agent intrusion detection system. (9th February 2009)

• Record Type: Journal Article
• Authors: Mosqueira-Rey, E.; Alonso-Betanzos, A.; Guijarro-Berdinas, B.; Alonso-Rios, D.; , J. Lago-Pineiro
• Is Part Of: International journal of intelligent information and database systems. Volume 3:Number 1(2009)
• Page Start: 107
• Page End: 121
• Publication Date: 2009-02-09
• Subjects: misuse detection -- intrusion detection -- intelligent agents -- multi-agent systems -- MAS -- Snort -- network packet sniffing -- JADE -- Drools-JBoss -- agent-based systems -- object-oriented techniques -- design patterns; Database management -- Computer programs -- Periodicals; Information retrieval -- Computer programs -- Periodicals; Information storage and retrieval systems -- Computer programs -- Periodicals; Artificial intelligence -- Periodicals; Expert systems (Computer science) -- Periodicals; Intelligent agents (Computer software) -- Periodicals; 006.33
• Languages: English
• ISSNs: 1751-5858

Abstract

We describe the design of a misuse detection agent, one of the distinct agents in a multi-agent-based intrusion detection system. This system is being implemented in JADE, a well-known multi-agent platform based in Java. The agent analyses the packets in the network connections using a packet sniffer and then creates a data model based on the information obtained. This data model is the input to a rule-based inference engine agent, which uses the Rete algorithm for pattern matching and the rules of the signature-based intrusion detection system, Snort. Specifically, an implementation in Java language – the Drools-JBoss Rules – was used and a parser was implemented that converts Snort rules into Drools rules. The use of object-oriented techniques, together with design patterns, means that the agent is flexible, easily configurable and extensible.