Abstract:Abstraction is an important issue in intrusion detection, since it not only hides the difference between heterogeneous systems, but also allows generic intrusion-detection models. However, abstraction is an error-prone process and is not well supported in current intrusion-detection systems (IDSs). This article presents a hierarchical model to support attack specification and event abstraction in distributed intrusion detection. The model involves three concepts: system view , signature , and view definition . A system view provides an abstract interface of a particular type of information; defined on the instances of system views, a signature specifies certain distributed attacks or events to be monitored; a view definition is then used to derive information from the matches of a signature and presents it through a system view. With the three elements, the model provides a hierarchical framework for maintaining signatures, system views, as well as event abstraction. As a benefit, the model allows generic signatures that can accommodate unknown variants of known attacks. Moreover, abstraction represented by a system view can be updated without changing either its specification or the signatures specified on its basis. This article then presents a decentralized method for autonomous but cooperative component systems to detect distributed attacks specified by signatures. Specifically, a signature is decomposed into finer units, called detection tasks , each of which represents the activity to be monitored on a component system. The component systems (involved in a signature) then perform the detection tasks cooperatively according to the "dependency" relationships among these tasks. An experimental system called CARDS has been implemented to test the feasibility of the proposed approach.

Distributed Architecture for Intrusion Detection System Based on Multi-Softman

Multi-agent based hybrid Intrusion detection system

On a Distributed Intrusion Detection Model Based on the Super-Peer Framework

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Research of Distributed Pre-Decision Engine in Wireless Intrusion Prevention Systems

Hybrid Intrusion Detection System for Complicated Network

Research on Improved Intrusion Detection System in Mobile Ad hoc Network

Intrusion Detection And Simulation For High-Speed Networks

Dynamic Hierarchical Distributed Intrusion Detection System Based on Multi-agent System

Intrusion Detection System Model Based on Multi Detection Technology

Mobile Agent Based Distributed Intrusion Detection System Model Protecting from Attack

A Distributed Intrusion Detection System Using Cooperating Agents

Design and Implementation of a Distributed Cooperative Intrusion Detection System

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

A Machine Learning Based Intrusion Detection System for Software Defined 5 G Network

A dynamically self-adaptive intrusion detection architecture for mobile ad hoc networks

A Distributed Intrusion Detecting System Based on Tridimensional Agent

Artificial Immune System Based Intrusion Detection In A Distributed Hierarchical Network Architecture Of Smart Grid

A cooperative intrusion detection system based on autonomous agents

Abstraction-based intrusion detection in distributed environments.

SPMOS-Based Intrusion Detection Architecture