Incremental Database Based on Distributed Ledger Technology for IDSs

Abstract

Intrusion Detection Systems (IDS) is an important technology for cyber security, as it can mitigate both inner and outer threats in networks. However, a critical problem in IDSs is that the detection capacity is gradually decaying with the emergence of unknown attacks. To constantly retrain IDSs with a more extensive database is critical to make IDSs adaptive with the ever-changing network environment, but the security institutes usually lack the motivation to persistently update and maintain the database for public. Thus, in this paper, a blockchain-based database (bc-DB) is proposed, which is multilaterally maintained by the security institutes and universities using Data Coins (DCoins) as the incentives. In addition, a Lifetime Learning IDS (LL-IDS) is further designed as the supplement of the bc-DB for common IDS users. After being retrained by the latest bc-DB, the LL-IDS can detect the newly discovered attacks while uploading the suspect network packets to the database. Simulation experiments show that the proposed LL-IDS with the bc-DB are secure and effectiveness in attacks detection.