Search

In improving security for the networks of today and tomorrow there are two important features that must be considered. The first is the open and distributed nature of today’s enterprise networks. And the second is their dynamic nature, not just in terms of size, but in terms of changing services offered, and the mobility of users. Of particular importance, then is the ability to rapidly apply new security policies in a system. Equally, a system should incorporate as much “intelligence” and reactivity in the system as possible. Many existing security solutions are designed for a static, known network, and are therefore unsuited to the requirements of today’s enterprise networks. In order to provide a system that can readily handle these requirements, recent works have shown that multi-agents systems offer a promising platform. The focus of our work concerns one critical security management issue that is intrusion detection. In this paper, we propose a model of managing security policies in a multi-agents system for intrusion detection.

The openness of business toward telecommunication networks in general and Internet in particular is performed at the prize of high security risks. Every professional knows that the only way to secure completely a private network is to make it unreachable. However, even if this solution was undertaken for many years, nowadays it is not possible to close private network especially for business purpose. Thus, security management becomes an important issue that must be considered carefully. The focus of our work concerns one critical security management issue that is intrusion detection. Some drawbacks of existing systems reveal the necessity of designing a new generation of self-adaptive systems. In fact, self-control, flexibility, adaptability, autonomy and distribution are the main features to be addressed in a suitable architecture that fulfils these requirements. The introduction of multi-agents system (MAS) in a network seems so promising to enable network entities to perform adaptive and “intelligent” behavior. “Intelligence” means that network entities provide reasoning capabilities, exhibit behavior autonomy, adaptability, interaction, communication and co-operation in order to reach specified goals. In this context, we propose a new approach for security management using intelligent agent (IA) technology. This approach provides a flexible integration of multi-agent technique in a classical network to enhance its protection level against inherent attacks.