A Multi-agents Intrusion Detection System Using Ontology and Clustering Techniques

Imen Brahmi (1) , Hanen Brahmi (1) , Sadok Ben Yahia (2, 3)

1 Université de Tunis
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 CNRS - Centre National de la Recherche Scientifique

Nowadays, the increase in technology has brought more sophisticated intrusions. Consequently, Intrusion Detection Systems (IDS) are quickly becoming a popular requirement in building a network security infrastructure. Most existing IDS are generally centralized and suffer from a number of drawbacks, e.g., high rates of false positives, low efficiency, etc, especially when they face distributed attacks. This paper introduces a novel hybrid multi-agents IDS based on the intelligent combination of a clustering technique and an ontology model, called OCMAS-IDS. The latter integrates the desirable features provided by the multi-agents methodology with the benefits of semantic relations as well as the high accuracy of the data mining technique. Carried out experiments showed the efficiency of our distributed IDS, that sharply outperforms other systems over real traffic and a set of simulated attacks.

Mots clés: Intrusion detection system; Multi-agents; Clustering; Ontology

Domaines: Informatique [cs]

Imen Brahmi, Hanen Brahmi, Sadok Ben Yahia. A Multi-agents Intrusion Detection System Using Ontology and Clustering Techniques. 5th International Conference on Computer Science and Its Applications (CIIA), May 2015, Saida, Algeria. pp.381-393, ⟨10.1007/978-3-319-19578-0_31⟩. ⟨hal-01789978⟩