Decentralized Event Correlation for Intrusion Detection

摘要: Evidence of attacks against a network and its resources is often scattered over several hosts. Intrusion detection systems (IDS) which attempt to detect such therefore have collect correlate information from different sources. We propose completely decentralized approach solve the task event correlation fusing data gathered multiple points within network.Our system models an intrusion as pattern events that can occur at hosts consists collaborating sensors deployed various locations throughout protected installation.We present specification language define intrusions distributed patterns mechanism specify their simple building blocks. The peer-to-peer algorithm these prototype implementation, called Quicksand, are described. Problems solutions involved in management discussed.