An Eztensible and Virtualization-Compatible IDS Management Architecture

摘要：

Efficient Intrusion Detection System (IDS) management is a prominent capability for distributed IDS solutions, which makes it possible to integrate and handle different types of sensors or collect and synthesize alerts generated from multiple hosts located in a loosely coupled environment. Extensibility is the main requirement for most of IDS management systems. The concept of virtualization has been introduced into many popular IDS implementations due to the advantage on isolation and fast recovery in case of being compromised. Advanced capability for combining these newly emerged Virtual Machine (VM) based IDS approaches is another requirement for IDS management. This paper proposes an extensible IDS management architecture based on a new design of Event Gatherer component. By using the known IDS standard IDMEF and a plugin concept, the Event Gatherer ensures fiexibility and compatibility. Experiments are carried out to demonstrate the extensibility and virtualizationcompatibility of the proposed IDS management architecture.

关键词： IDS IDS Management VM virtualization IDMEF

作者: Sebastian Roschke Feng Cheng Christoph Meinel

作者单位: Hasso Plattner Institute (HPI),University of Potsdam P.O.Box 900460,14440,Potsdam,Germany

会议类型: 国际会议

会议名称: The Fifth International Conference on Information Assurance and Security(第五届信息保障与安全国际会议)

会议地点: 西安

会议语种:英文

页码: 130-134

在线出版日期: 2009-08-18（万方平台首次上网日期，不代表论文的发表时间）