<italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection
The destructive effects of cyber-attacks demand more proactive security approaches. One such promising approach is the idea of collaborative intrusion detection systems (CIDSs). These systems combine the knowledge of multiple sensors (e.g., intrusion detection systems, honeypots, or firewalls) to cr...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2018-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8529228/ |
| _version_ | 1819120489708126208 |
|---|---|
| author | Carlos Garcia Cordero Giulia Traverso Mehrdad Nojoumian Sheikh Mahbub Habib Max Muhlhauser Johannes Buchmann Emmanouil Vasilomanolakis |
| author_facet | Carlos Garcia Cordero Giulia Traverso Mehrdad Nojoumian Sheikh Mahbub Habib Max Muhlhauser Johannes Buchmann Emmanouil Vasilomanolakis |
| author_sort | Carlos Garcia Cordero |
| collection | DOAJ |
| description | The destructive effects of cyber-attacks demand more proactive security approaches. One such promising approach is the idea of collaborative intrusion detection systems (CIDSs). These systems combine the knowledge of multiple sensors (e.g., intrusion detection systems, honeypots, or firewalls) to create a holistic picture of a monitored network. Sensors monitor parts of a network and exchange alert data to learn from each other, improve their detection capabilities and ultimately identify sophisticated attacks. Nevertheless, if one or a group of sensors is unreliable (due to incompetence or malice), the system might miss important information needed to detect attacks. In this paper, we propose <italic>Sphinx</italic>, an evidence-based trust mechanism capable of detecting unreliable sensors within a CIDS. The <italic>Sphinx</italic> detects, both, single sensors or coalitions of dishonest sensors that lie about the reliability of others to boost or worsen their trust score. Our evaluation shows that, given an honest majority of sensors, dishonesty is punished in a timely manner. Moreover, if several coalitions exist, even when more than 50% of all sensors are dishonest, dishonesty is punished. |
| first_indexed | 2024-12-22T06:21:29Z |
| format | Article |
| id | doaj.art-ef99bbdc052c4a6d82bb62fcc4ee5e18 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-22T06:21:29Z |
| publishDate | 2018-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-ef99bbdc052c4a6d82bb62fcc4ee5e182022-12-21T18:35:58ZengIEEEIEEE Access2169-35362018-01-016724277243810.1109/ACCESS.2018.28802978529228<italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion DetectionCarlos Garcia Cordero0Giulia Traverso1Mehrdad Nojoumian2Sheikh Mahbub Habib3Max Muhlhauser4Johannes Buchmann5Emmanouil Vasilomanolakis6https://orcid.org/0000-0001-5068-9158Department of Computer Science, Technische Universität Darmstadt, Darmstadt, GermanyDepartment of Computer Science, Technische Universität Darmstadt, Darmstadt, GermanyDepartment of Computer and Electrical Engineering and Computer Science, Florida Atlantic University, Boca Raton, FL, USAContinental AG, Frankfurt, GermanyDepartment of Computer Science, Technische Universität Darmstadt, Darmstadt, GermanyDepartment of Computer Science, Technische Universität Darmstadt, Darmstadt, GermanyDepartment of Computer Science, Technische Universität Darmstadt, Darmstadt, GermanyThe destructive effects of cyber-attacks demand more proactive security approaches. One such promising approach is the idea of collaborative intrusion detection systems (CIDSs). These systems combine the knowledge of multiple sensors (e.g., intrusion detection systems, honeypots, or firewalls) to create a holistic picture of a monitored network. Sensors monitor parts of a network and exchange alert data to learn from each other, improve their detection capabilities and ultimately identify sophisticated attacks. Nevertheless, if one or a group of sensors is unreliable (due to incompetence or malice), the system might miss important information needed to detect attacks. In this paper, we propose <italic>Sphinx</italic>, an evidence-based trust mechanism capable of detecting unreliable sensors within a CIDS. The <italic>Sphinx</italic> detects, both, single sensors or coalitions of dishonest sensors that lie about the reliability of others to boost or worsen their trust score. Our evaluation shows that, given an honest majority of sensors, dishonesty is punished in a timely manner. Moreover, if several coalitions exist, even when more than 50% of all sensors are dishonest, dishonesty is punished.https://ieeexplore.ieee.org/document/8529228/Clusteringcollaborative intrusion detectionmachine learningmixture modelssensor reliabilitytrust management |
| spellingShingle | Carlos Garcia Cordero Giulia Traverso Mehrdad Nojoumian Sheikh Mahbub Habib Max Muhlhauser Johannes Buchmann Emmanouil Vasilomanolakis <italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection IEEE Access Clustering collaborative intrusion detection machine learning mixture models sensor reliability trust management |
| title | <italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection |
| title_full | <italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection |
| title_fullStr | <italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection |
| title_full_unstemmed | <italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection |
| title_short | <italic>Sphinx</italic>: a Colluder-Resistant Trust Mechanism for Collaborative Intrusion Detection |
| title_sort | italic sphinx italic a colluder resistant trust mechanism for collaborative intrusion detection |
| topic | Clustering collaborative intrusion detection machine learning mixture models sensor reliability trust management |
| url | https://ieeexplore.ieee.org/document/8529228/ |
| work_keys_str_mv | AT carlosgarciacordero italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection AT giuliatraverso italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection AT mehrdadnojoumian italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection AT sheikhmahbubhabib italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection AT maxmuhlhauser italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection AT johannesbuchmann italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection AT emmanouilvasilomanolakis italicsphinxitalicacolluderresistanttrustmechanismforcollaborativeintrusiondetection |