Abstract:Abstraction is an important issue in intrusion detection, since it not only hides the difference between heterogeneous systems, but also allows generic intrusion-detection models. However, abstraction is an error-prone process and is not well supported in current intrusion-detection systems (IDSs). This article presents a hierarchical model to support attack specification and event abstraction in distributed intrusion detection. The model involves three concepts: system view , signature , and view definition . A system view provides an abstract interface of a particular type of information; defined on the instances of system views, a signature specifies certain distributed attacks or events to be monitored; a view definition is then used to derive information from the matches of a signature and presents it through a system view. With the three elements, the model provides a hierarchical framework for maintaining signatures, system views, as well as event abstraction. As a benefit, the model allows generic signatures that can accommodate unknown variants of known attacks. Moreover, abstraction represented by a system view can be updated without changing either its specification or the signatures specified on its basis. This article then presents a decentralized method for autonomous but cooperative component systems to detect distributed attacks specified by signatures. Specifically, a signature is decomposed into finer units, called detection tasks , each of which represents the activity to be monitored on a component system. The component systems (involved in a signature) then perform the detection tasks cooperatively according to the "dependency" relationships among these tasks. An experimental system called CARDS has been implemented to test the feasibility of the proposed approach.

Design of an Intrusion Detection Model for Detecting Distributed Attacks

Multi-agent based hybrid Intrusion detection system

Research on Data Mining-based Intrusion Detection in Real-time Environment

Intrusion Detection And Simulation For High-Speed Networks

Abstraction-based intrusion detection in distributed environments.

Research on distributed intrusion detection system based on Protocol analysis

Distributed Detection of Network Intrusions Based on a Parametric Model.

Design and Implementation of a Distributed Cooperative Intrusion Detection System

Research and Design of Multi-Agent-Based Distributed Intrusion Detection Systems

A Host-based Multi-layer Intrusion Detection Model and Its Detection Methods

Research and Design of Intrusion Detection Systems Based on SNMP

Research on the Strategy of Large-scale Distributed Intrusion Detection Systems

Design of an Intrusion Detection Model under Linux Based on System-call Monitoring

Design and Implementation of Distributed Intrusion Detection System Based on P2DR Model

A Detection Model for Distributed Denial of Service Attacks Based on Network Connection Analysis

Design on Combination System of Distributed Firewall and Invading Detection

Peer-To-Peer Based Intrusion Detection Modeling And Analysis

Adaptive Distributed Intrusion Detection Using Parametric Model

A Hierarchical Model for Distributed Attacks

Self-organized Hierarchical Massive Network Intrusion Detection System

Specification-based Distributed Detection for Mobile Ad Hoc Networks