Towards Reliable CIDS: Hybrid Reputation and Challenge Strategies for Combating Internal Attacks

Collaborative Intrusion Detection Systems (CIDS) serve as crucial firewalls, maintaining system security through necessary information exchange and integration among nodes in distributed systems. While CIDS excel at defending against external network attacks, internal threats remain a significant challenge. To identify malicious internal nodes, researchers typically adopt trust management mechanisms. However, current methods often fail to effectively take into account nodes' global reputation and historical behavior. Recognizing the similarities between distributed networks and social networks, we propose a hybrid trust computation mechanism based on social network reputation theory and develop a high-performance node clustering model. Simulated experiments conducted on a network with 50 nodes demonstrate that our method achieves higher accuracy and recall rates in identifying malicious nodes under adverse conditions compared to traditional methods, thereby enhancing the resilience of distributed networks against internal attacks.