SeDID: An SGX-enabled decentralized intrusion detection framework for network trust evaluation

Gao Liu, Zheng Yan, Wei Feng, Xuyang Jing, Yaxing Chen, Mohammed Atiquzzaman

Research output: Contribution to journalArticleScientificpeer-review

1 Citation (Scopus)

Abstract

In order to evaluate network trust, different intrusion detection methods have been proposed. However, it is difficult for a single detection node to collect massive data and perform detection and evaluation in a large-scale network. In addition, disclosure of security-related data and detection pattern might weaken data provision incentives due to privacy concern, which could result in deliberately forging data to evade detection. Current literature still lacks a general framework to conduct decentralized intrusion detection towards network trust evaluation with privacy preservation. In this paper, we propose SeDID, a Software Guard Extension (SGX)-enabled decentralized intrusion detection framework for network trust evaluation based on blockchain. We design a novel consensus mechanism to avoid forking and guarantee high efficiency and real decentralization, where block creation is uniquely consented by miners and block creation difficulty is determined by the number of blocks previously created by a relative miner within a time window. The smaller the number, the easier the miner creates a new block. SeDID also offers incentives according to node contributions for motivating security-related data collection, intrusion detection and network trust evaluation. Additional employment of Intel SGX makes SeDID preserve both data and pattern privacy. We analyze SeDID’s efficacy in terms of incentive, privacy preservation and security. Its performance is further evaluated through simulations. In specific settings, its block creation time, task completion time and throughput are 19.61s, 44.55s and 224.47 transactions/s, respectively. Compared with state-of-the-art systems, SeDID offers better performance, which implies its potential to be applied in practice.
Original languageEnglish
Pages (from-to)100-114
Number of pages15
JournalInformation Fusion
Volume70
Early online date2021
DOIs
Publication statusE-pub ahead of print - 2021
MoE publication typeA1 Journal article-refereed

Keywords

  • Intrusion detection
  • Network trust evaluation
  • Blockchain
  • Intel SGX
  • Privacy preservation

Fingerprint Dive into the research topics of 'SeDID: An SGX-enabled decentralized intrusion detection framework for network trust evaluation'. Together they form a unique fingerprint.

Cite this