Multi-paradigm frameworks for scalable intrusion detection

摘要: Research in network security and intrusion detection systems (IDSs) has typically focused on small or artificial data sets. Tools are developed that work well these sets but have trouble meeting the demands of real-world, large-scale environments. In addressing this problem, improvements must be made to foundations systems, including management, IDS accuracy alert volume. We address management information by presenting a database mediator system provides single query access via domain specific language. Results returned form XML using web services, allowing analysts from remote networks uniform manner. The also scalable capture log for multi-terabyte datasets. Next, we building an agent-based framework utilizes services make easy deploy capable spanning boundaries. Agents process alerts managed central broker. broker can define processing hierarchies assigning dependencies agents achieve scalability. used task event correlation, gathering relevant alert. Lastly, volume approach correlation is independent. Using correlated events gathered our agent framework, build feature vector each representing traffic profile internal host at time This as statistical fingerprint clustering algorithm groups related alerts. We analyze results with combination expert evaluation selection.