Abstract
Collaborative Intrusion Detection Systems (CIDS) are increasingly adopted to counter cyberattacks, as their collaborative nature enables them to adapt to diverse scenarios across heterogeneous environments. As distributed critical infrastructure operates in rapidly evolving environments, such as drones in both civil and military domains, there is a growing need for CIDS architectures that can flexibly accommodate these dynamic changes. In this study, we propose a novel CIDS framework designed for easy deployment across diverse distributed environments. The framework dynamically optimizes detector allocation per node based on available resources and data types, enabling rapid adaptation to new operational scenarios with minimal computational overhead. We first conducted a comprehensive literature review to identify key characteristics of existing CIDS architectures. Based on these insights and real-world use cases, we developed our CIDS framework, which we evaluated using several distributed datasets that feature different attack chains and network topologies. Notably, we introduce a public dataset based on a realistic cyberattack targeting a ground drone aimed at sabotaging critical infrastructure. Experimental results demonstrate that the proposed CIDS framework can achieve adaptive, efficient intrusion detection in distributed settings, automatically reconfiguring detectors to maintain an optimal configuration, without requiring heavy computation, since all experiments were conducted on edge devices.
Abstract (translated)
协作入侵检测系统（CIDS）被越来越多地采用，以应对网络攻击，因为它们的协作性质使它们能够适应异构环境中各种场景的变化。鉴于分布式关键基础设施在快速变化的环境中运行，例如民用和军事领域的无人机，对于可以灵活适应这些动态变化的CIDS架构的需求正在不断增加。在这项研究中，我们提出了一种新型的CIDS框架，旨在易于部署于多样化的分布式环境。该框架根据可用资源和数据类型动态优化每个节点上的检测器分配，从而能够快速适应新的操作场景，并且计算开销极小。 首先，我们进行了全面的文献回顾以确定现有CIDS架构的关键特征。基于这些见解和实际应用场景，我们开发了我们的CIDS框架，并使用包含不同攻击链和网络拓扑的几个分布式数据集对其进行了评估。值得注意的是，我们引入了一个基于针对地面上破坏关键基础设施的无人机进行的真实网络攻击的公开数据集。 实验结果表明，所提出的CIDS框架能够在分布式环境中实现自适应、高效的入侵检测，自动重新配置检测器以保持最优配置，并且无需进行大量计算，因为所有试验均在边缘设备上完成。
URL
https://arxiv.org/abs/2602.11851
