Mobile Agent (MA) Based Intrusion Detection Systems (IDS): A Systematic Review

An Intrusion Detection System (IDS) identifies the attacks by analysing the events, considered undesirable from a security perspective, in systems and networks. It is necessary for organizations to install IDS for the protection of sensitive data due to an increase in the number of incidents related to network security. It is difficult to detect intrusions from a segment that is outside a network as well as an intrusion that originated from inside a distributed network. It should be the responsibility of IDS to analyse a huge amount of data without overloading the networks and monitoring systems. Mobile agents (MA) emerged due to the deficiencies and limitations in centralized IDS. These agents can perform predefined actions by detecting malicious activities. From previously published literature, it was deduced that most of the existing IDS based on MA are not significantly effective due to limited intrusion detection and high detection time. This study categorized existing IDS and available MA-IDS to conduct a strategic review focusing on the classification of each category, that is, data collection modes, architecture, analysis techniques, and security. The limitations and strengths of the discussed IDS are presented/showcased wherever applicable. Additionally, this study suggested ways to improve the efficiency of available MA-IDS in order to secure distributed networks in the future. This overview also includes different implementations of agent based IDS. INDEX TERMS: data mining, distributed systems, Intrusion Detection System (IDS), Mobile Agents (MA), network security