Distributed Intrusion Detection System Based on Mixed Cooperative and Non-Cooperative Game Theoretical Model

Intrusion Detection Systems (IDS) are systems to protect the network resources against the attacks. Considering the extent of the attacks in the internet environment and the change in the form and type of the attacks from the centralized to the distributed strategy, such systems also tend to move towards the distributed architecture. In this paper, a mobile agent based method working as suspicious movements detection sensors has been proposed. The attack detecting White Globule Agents (WGA) scatter in the network; moving from a node to another, they build a Security Overlay Network at a time and using a kind of collaborative game and communication, and after reaching to the desired Shapley value, they can detect and report the origin and level of the attack. The proposed method in this study includes a scenario in which the WGA in a non-cooperative game against the attacker element tries to develop a negotiation to calculate the Nash equilibrium point and attain maximum utility, so that meanwhile separating the attacks from the real requests, the security level of the attack is obtained with the aid from other WGAs.