Abstract:Abstraction is an important issue in intrusion detection, since it not only hides the difference between heterogeneous systems, but also allows generic intrusion-detection models. However, abstraction is an error-prone process and is not well supported in current intrusion-detection systems (IDSs). This article presents a hierarchical model to support attack specification and event abstraction in distributed intrusion detection. The model involves three concepts: system view , signature , and view definition . A system view provides an abstract interface of a particular type of information; defined on the instances of system views, a signature specifies certain distributed attacks or events to be monitored; a view definition is then used to derive information from the matches of a signature and presents it through a system view. With the three elements, the model provides a hierarchical framework for maintaining signatures, system views, as well as event abstraction. As a benefit, the model allows generic signatures that can accommodate unknown variants of known attacks. Moreover, abstraction represented by a system view can be updated without changing either its specification or the signatures specified on its basis. This article then presents a decentralized method for autonomous but cooperative component systems to detect distributed attacks specified by signatures. Specifically, a signature is decomposed into finer units, called detection tasks , each of which represents the activity to be monitored on a component system. The component systems (involved in a signature) then perform the detection tasks cooperatively according to the "dependency" relationships among these tasks. An experimental system called CARDS has been implemented to test the feasibility of the proposed approach.

Grid computing oriented on-demand intrusion detection model

On a Distributed Intrusion Detection Model Based on the Super-Peer Framework

A New Flexible Multi-Agent Approach To Intrusion Detection For Grid

Multi-agent based hybrid Intrusion detection system

Ghids: Defending Computational Grids Against Misusing of Shared Resources

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Adaptive Distributed Intrusion Detection Using Parametric Model

T-Grid: A Domain based Trusted Grid Model with Purging ofUntrustworthy Transactions

A Distributed and Autonomous Guard System Based on Cloud Environments

A Grid Computing Based Approach For The Power System Dynamic Security Assessment

Distributed Detection of Network Intrusions Based on a Parametric Model.

A Research On The Integration Of The Computational Grid Structure In Fault Diagnosis

Peer-To-Peer Based Intrusion Detection Modeling And Analysis

A dynamically self-adaptive intrusion detection architecture for mobile ad hoc networks

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

An Enhanced Intrusion Detection Method for AIM of Smart Grid.

Artificial Immune System Based Intrusion Detection In A Distributed Hierarchical Network Architecture Of Smart Grid

Abstraction-based intrusion detection in distributed environments.

Dynamic Hierarchical Distributed Intrusion Detection System Based on Multi-agent System

Virtual Battlefield Attack-Defense Countermeasure Simulation On The Grid

Research on Dynamic Adaptive Intrusion Detection Model