Agent-based distributed intrusion source identification

Network-based intrusion has become a serious threat to networked information systems. Yet, the current network security mechanisms are passive in response to network-based intrusions. In order to hide their origins, intruders usually use incorrect or spoofed source IP addresses breaking into targets. It is difficult to identify the real source of these network-based intrusions due to the nature of the IP protocol. This paper presents the design of distributed intrusion source identification system (DISIS) based on agents. It is comprised of several agents of different types, which can be developed respectively. The agents communicate with each other when they take their actions. DISIS can cooperate with any other intrusion detection system. This system can be installed in router or a dedicated device connected to router. DISIS can trace single source attack or multiple sources attack on-line or off-line.