Dependency-based distributed intrusion detection

摘要: Distributed network intrusion detection has attracted much attention recently. Our main focus in this work is on zero-day, slow-scanning worms, of which no existing signatures are available. We organize end hosts into regions based knowledge, we posit positively correlated to the dependency structure. Leveraging organization, apply different techniques within and across regions. use a hidden Markov model (HMM) region capture among hosts, sequential hypothesis testing (SHT) globally take advantage independence between conduct experiments DETER, preliminary results show improvement effectiveness reduction communication overhead.