Agent Based Distributed and Cooperative Intrusion Detection for Mobile Ad Hoc Networks

In this proposal, Intelligent Automation, Inc. (IAI) and its consultant, Dr. Wenke Lee, propose to develop an intelligent agent-based distributed and cooperative anomaly and fault monitoring architecture for mobile ad-hoc network (MANET). In our proposed architecture, an anomaly and fault detection agent runs at each "monitoring" node and performs local data collection and local detection. Once an anomaly or fault is detected by a local "monitoring" agent, it collaborates with neighboring "monitoring" agents to perform cooperative detection, to investigate the source of the anomaly or fault, and to take cooperative response actions. We will develop an adaptive learning-based approach for building anomaly and fault detection models, which can be applied to both local and cooperative detection. RIPPER and Support Vector Machines (SVMs) will be used to detect intrusions and faults in MANET. The multi-agent cooperative monitoring and communication architecture will be designed based on IAI's novel Cybele agent infrastructure. The key innovations of the proposed architecture include: 1) dynamical and flexible configuration based on the agent technology; 2) the learning-based detection framework is able to detect new attacks or fautls; 3) low false alarm rate by using a cooperative detection engine; 4) excellent classification performance of RIPPER and SVMs, etc.