Distributed and coordinated attacks in computer networks are causing considerable economic losses worldwide in recent years. This is mainly due to the transition of attackers’ operational patterns towards a more sophisticated and more global behavior. This fact is leading current intrusion detection systems to be more likely to generate false alarms. In this context, this paper describes the design of a collaborative intrusion detection network (CIDN) that is capable of building and sharing collective knowledge about isolated alarms in order to efficiently and accurately detect distributed attacks. It has been also strengthened with a reputation mechanism aimed to improve the detection coverage by dropping false or bogus alarms that arise from malicious or misbehaving nodes. This model will enable a CIDN to detect malicious behaviors according to the trustworthiness of the alarm issuers, calculated from previous interactions with the system. Experimental results will finally demonstrate how entities are gradually isolated as their behavior worsens throughout the time.

This work would not have been possible without the inestimable contribution of:

• Manuel Gil Pérez
• Gregorio Martínez Pérez
• Antonio F. Gómez Skarmeta

Manuel Gil Pérez, Félix Gómez Mármol, Gregorio Martínez Pérez, Antonio F. Gómez Skarmeta, «RepCIDN: a reputation-based collaborative intrusion detection network to lessen the impact of malicious alarms«, Journal of Network and Systems Management, vol. 21, no. 1, pp. 128-167, 2013

• Journal: Journal of Network and Systems Management
• Category: Telecommunications
• Rank: 65/78
• Quartile: Q4
• Impact Factor: 0.438

• Top 5 most downloaded articles in the last 30 days (from 25/05/2012 until 05/11/2012)
• Top 5 most downloaded articles in the last 90 days (from 07/06/2012 until 01/12/2012)