Anomaly Detection in Network Traffic using Distributed Self-Organizing Multi Agent Systems

Challenges in the field of information and communication security are of great interest to researchers. The expansion of network boundaries, the intensification and complexity increase of network security attacks, has amplified the need for intelligent, automated and real-time systems to detect network anomalies and threats. To detect anomalies, network traffic needs to be monitored immediately. The anomaly involves significant and unusual changes in network traffic behavior compared to its normal behavior patterns. In this paper, in order to detect anomalies, a system based on self-organizing multi agent systems is presented. Multi agent systems are made up of agents that interact with each other to achieve a specific goal. These systems are used to solve problems that are difficult for a single agent to solve or integrate. The proposed system architecture is scalable and can adapt to changes in today's networks. The evaluation and analysis of the proposed system in the NSL-KDD dataset shows that the rate of anomalies detection has improved compared to the recently proposed methods. Also, by proposing an algorithm to optimize the agents’ choices and another one for intelligent agents’ decision weighting, the rate of anomaly detection is increased and the time of event analysis is reduced.