Collaborative intrusion detection system (CIDS): A framework for accurate and efficient IDS

Yu-Sung Wu, Bingrui Foo, Yongguo Mei, Saurabh Bagchi

研究成果: Conference contribution同行評審

97 引文 斯高帕斯(Scopus)

摘要

We present the design and implementation of a collaborative intrusion detection system (CIDS) for accurate and efficient intrusion detection in a distributed system. CIDS employs multiple specialized detectors at the different layers - network, kernel and application - and a manager based framework for aggregating the alarms from the different detectors to provide a combined alarm for an intrusion. The premise is that a carefully designed and configured CIDS can increase the accuracy of detection compared to individual detectors, without a substantial degradation in performance. In order to validate the premise, we present the design and implementation of a CIDS which employs Snort, Libsafe, and a new kernel level IDS called Sysmon. The manager has a graph-based and a Bayesian network based aggregation method for combining the alarms to finally come up with a decision about the intrusion. The system is evaluated using a Web-based electronic store front application and under three different classes of attacks - buffer overflow, flooding and script-based attacks. The results show performance degradations compared to no detection of 3.9% and 6.3% under normal workload and a buffer overflow attack respectively. The experiments to evaluate the accuracy of the system show that the normal workload generates false alarms for Snort and the elementary detectors produce missed alarms. CIDS does not flag the false alarm and reduces the incidence of missed alarms to 1 of the 7 cases. CIDS can also be used to measure the propagation time of an intrusion which is useful in choosing an appropriate response strategy.

原文English
主出版物標題Proceedings - 19th Annual Computer Security Applications Conference, ACSAC 2003
發行者IEEE Computer Society
頁面234-244
頁數11
ISBN(電子)0769520413
DOIs
出版狀態Published - 1 一月 2003
事件19th Annual Computer Security Applications Conference, ACSAC 2003 - Las Vegas, United States
持續時間: 8 十二月 200312 十二月 2003

出版系列

名字Proceedings - Annual Computer Security Applications Conference, ACSAC
2003-January
ISSN(列印)1063-9527

Conference

Conference19th Annual Computer Security Applications Conference, ACSAC 2003
國家United States
城市Las Vegas
期間8/12/0312/12/03

指紋 深入研究「Collaborative intrusion detection system (CIDS): A framework for accurate and efficient IDS」主題。共同形成了獨特的指紋。

引用此