1. Chapter 9: Cooperation in Intrusion Detection Networks Authors: Carol Fung and Raouf Boutaba Editors: M. S. Obaidat and S. Misra Jon Wiley & Sons publishing

2. Network Intrusions Unwanted traffic or computer activities that may be malicious and destructive –Denial of Service –Identity theft –Spam mails Single-host intrusion Cooperative attacks

3. Intrusion Detection Systems Designed to monitor network traffic or computer activities and alert administrators for suspicious intrusions –Signature-based and anomaly-based –Host-based and network-based

4. Figure 1. An example of host-based IDS and Network-based IDS

5. Cooperative IDS IDSs use collective information from others to make more accurate intrusion detection Several features of CIDN –Topology –Cooperation Scope –Specialization –Cooperation Technology

6. Cooperation Technology Data Correlation Trust Management Load balance

7. Table 1. Classification of Cooperative Intrusion Detection Networks IDNTopologyScopeSpecializationTechnology and algorithm IndraDistributedLocalWorm- DOMINODecentralizedHybridWorm- DShieldCentralizedGlobalGeneralData Correlation NetShieldDistributedGlobalWormLoad-balancing GossipDistributedLocalWorm- Worminator-GlobalWorm- ABDIASDecentralizedHybridGeneralTrust Management CRIMCentralizedLocalGeneralData Correlation HBCIDSDistributedGlobalGeneralTrust Management ALPACASDistributedGlobalSpamLoad-balancing CDDHTDecentralizedLocalGeneral- SmartScreenCentralizedGlobalPhishing- FFCIDNCentralizedGlobalBotnetData correlation

8. Indra A early proposal on Cooperative intrusion detection Cooperation nodes take proactive approach to share black list with others

9. DOMINO Monitor internet outbreaks for large-scale networks Nodes are organized hierarchically Different roles are assigned to nodes

10. Dshield A centralized firewall log correlation system Data is from the SANS internet storm center Not a real time analysis system Data payload is removed for privacy concern

11. NetShield A fully distributed system to monitor epidemic worm and DoS attacks The DHT Chord P2P system is used to load-balance the participating nodes Alarm is triggered if the local prevalence of a content block exceeds a threshold Only works on worms with fixed attacking traces, not work on polymorphic worms

12. Gossip-based Intrusion Detection A local epidemic worm monitoring system A local detector raises a alert when the number of newly created connections exceeds a threshold A Bayesian network analysis system is used to correlate and aggregate alerts

13. ABDIAS Agent-based Distributed alert system IDSs are grouped into communities Intra-community/inter-community communication A Bayesian network system is used to make decisions

14. CRIM A centralized system to collect alerts from participating IDSs Alert correlation rules are generated by humans offline New rules are used to detect global-wide intrusions

15. Host-based CIDS A cooperative intrusion system where IDSs share detection experience with others Alerts from one host is sent to neighbors for analysis Feedback is aggregated based on the trust-worthiness of the neighbor Trust values are updated after every interaction experience

16. ALPACAS A cooperative spam filtering system Preserve the privacy of the email owners A p2p system is used for the scalability of the system Emails are divided into feature trunks and digested into feature finger prints

17. SmartScreen Phsihing URL filtering system in IE8 Allow users to report phishing websites A centralized decision system to analyze collected data and make generate the blacklist Users browsing a phishing site will be warned by SmartScreen

18. FFCIDN A collaborative intrusion detection network to detect fastflux botnet Observe the number of unique IP addresses a domain has. A threshold is derived to decide whether the domain is a fastflux phishing domain

19. Open Challenges Privacy of the exchanged information Incentive of IDS cooperation Botnet detection and removal

20. Conclusion CIDNs use collective information from participants to achieve higher intrusion detection accuracy A taxonomy to categorize different CIDNs –Four features are proposed for the taxonomy The future challenges include how to encourage participation and provide privacy for data-sharing among IDSs