A distributed multi-level anomalies detection system using the mobile agent approach

摘要

Nowadays, network infrastructures are supervised by human operators. These operators are submerged by a massive surcharge of information and alerts caused by security mechanisms. In this paper, we focus particularly in anomalies detection systems and propose a multi-levels architecture allowing in one hand, the enhancement of the diagnosis' quality for security administrator support by filtering faulty alerts and on the other hand the detection of hidden anomalies undetectable in real time; we will introduce a distributed architecture based on the mobile agents' paradigm which exploits several types of anomalies' detectors outputs and contributes to reduce and improve alerts at several levels in synchronous and asynchronous modes.