Computationally intelligent agents for distributed intrusion detection system and method of practicing same
View Patent ↗A computer-implemented intrusion detection system and method for detecting computer network intrusions in real time are provided. A feature ranking algorithm is used to extract features of interest from a network and network activity. A kernel-based algorithm is used to analyze such features to determine if they are normal or malicious. If malicious, the activity is caused to be blocked.
1. A method of detecting intrusions on at least one computer in a computer network, including the steps of:
providing a computer-readable medium encoded with an intrusion detection system, said intrusion detection system comprising a feature ranking algorithm configured to extract features of interest from a network and network activity; a plurality of support vector machines, wherein each of said support vector machines is a kernel-based algorithm configured to analyze extract features of interest to determine whether said extracted features are normal or malicious;
using said feature ranking algorithm to extract features of interest from a network and network activity;
using said kernel-based algorithm to analyze extracted features of interest to determine if said extracted features are normal or malicious;
if said extract features are determined to be malicious, causing said activity to be denied prior to access, terminated after access, limited in scope, honey-potted or tracked; and
based on whether said activity is denied prior to access, terminated after access, limited in scope, honey-potted or tracked, determining that an intrusion onto said computer has occurred.
2. The method according to claim 1 , wherein said step of analyzing is accomplished semi-autonomously, and is tailored to a specific device being monitored.
3. The method according to claim 2 , wherein said device being monitored includes network devices including routers, switches, hubs and access points; perimeter defense devices including firewalls, VPNs and authentication devices; and peripheral wired and wireless devices including PDAs, cell phones, laptops, PCs and servers.
4. The method according to claim 2 , wherein a hierarchy of agents is provided to effect said semi-autonomous analysis.
5. The method according to claim 4 , wherein said agents accomplish at least one of assessing risk at their dispatched location, providing management functions, collecting data, communicating and coordinating with one another, sharing computational resources, providing vulnerability scanning, and providing authentication.
6. The method according to claim 4 , which includes altering a sensitivity level of an agent's analysis.
7. The method according to claim 4 , wherein said management functions include dispatching an appropriate number and type of agents, monitoring and controlling dispatched agents, recalling dispatched agents, and reprogramming or updating agents.