• hybrid system
• intrusion detection
• multi-agent
• collaborative
• IDS

In this thesis we propose a solution for the problem of detecting intruders in an open set of cooperative agents. An agent can perform a finite set of maneuvers and is modeled by a hybrid system whose state is a continuous and a discrete part, representing the agents' physical evolution and logical variables, respectively. Each agent plans its behavior and chooses the appropriate maneuver to perform following a common set of shared rules designed to ensure the safety of the entire system. Since the number of agents is unknown, and since these agents have a limited knowledge of their neighborhood, they can make decisions based only on their own position, and on the configuration of a limited number of surrounding agents. Such a planning strategy is said to be decentralized.

The expounded solution is an Intrusion Detecting System (IDS), based on a decentralized monitoring strategy, performed by several common local monitor modules running on--board each agent. This module tries to evaluate the behavior of neighboring agents by estimating the occurrence of the logical events described in the shared rule set. Since each monitor has a limited vision of its neighbors, in many cases it can remain uncertain about the correctness of the monitored agent's behavior. In order to solve this problem we developed a distributed consensus algorithm which, by introducing communication between agents, enhances the intrusion detection capabilities of single monitors. The effectiveness of our solution has been proved by in-depth simulations and a theoretical demonstration of the convergence of the consensus algorithm.