A Collaborative Architecture for Intrusion Detection Systems with Intelligent Agents and Knowledge-Based Alert Evaluation

摘要：

Current reactive and standalone network securityproducts are not capable of withstanding the thriving ofdiversified network threats. As a result, a new securityparadigm where integrated security devices or systemscollaborate closely to achieve enhanced protection andprovide multi-layer defenses is emerging. In this paper,we present a collaborative architecture design formultiple intrusion detection systems to work together todetect real-time network intrusions. The architecture iscomposed of three parts: Collaborative AlertAggregation, Knowledge-based Alert Evaluation andAlert Correlation. The architecture is aimed at reducingthe alert overload by correlating from multiple sensorsto generate condensed views, reducing false positivesby integrating network and host system information andcorrelating events based on logical relations to generateglobal and synthesized alert report. The first two partsof the architecture have been implemented and theimplementation results are presented in this paper.

作者: Jinqiao Yu Y. V. Ramana Reddy Sentil SeUiah Srinivas Kankanahalli Sumitra Reddy Vijayanand Bharadwaj

作者单位: SIPLab,Concurrent Engineering Research Center Lane Department of Computer Science and Electrical Engineering West Virginia University Morgantown,WV26506

会议类型: 国际会议

会议名称: The 8th International Conference on Computer Supported Cooperative Work in Design(第八届计算机支持的协同工作设计国际会议)(CSCWD2004)

会议地点: 厦门

会议语种:英文

页码: 271-276

在线出版日期: 2004-05-26（万方平台首次上网日期，不代表论文的发表时间）