Journal of University of Chinese Academy of Sciences >
A Study on Information Exchange and Cooperation in Distributed Intrusion Detection Systems
Received date: 2004-05-11
Online published: 2005-03-15
Information exchange and cooperation between components acts as the key problem of distributed intrusion detection system.According to DIDS based on Hierarchical Cooperation Model (HCM), we analyze the requirements of information exchange between detection components in this model.We present the Extended Intrusion Detection Message Exchange Format (EIDMEF)to provide a standard description format which contributes to efficient information exchange and cooperation, such as reporting intrusion incidents, collecting audit data,performing cooperative detection and activating distributed responses to intrusive behaviors.Workflows of information exchange and processing procedure in this model when confronted with different kinds of intrusions are also depicted in detail.
LIAN Yi-Feng . A Study on Information Exchange and Cooperation in Distributed Intrusion Detection Systems[J]. Journal of University of Chinese Academy of Sciences, 2005 , 22(2) : 202 -209 . DOI: 10.7523/j.issn.2095-6134.2005.2.013
[1] Lian YF, Dai YX, Hu Y.A study of distributed intrusion detection model.Computer Research and Development, 2003, 40(8):1195 ～ 1202 (inChinese with English abstract)
[2] Kahn C, Porras PA, Staniford-Chen S, et al.A common int rusion detection framework.S ubmi tted to Journal of Computer Security, 1998
[3] Intrusion Detection Working Group.The intrusion detectionmessage exchange format (draft-ietf-idwg-idmef-xml-11).2004.http : www.ietf.orginternet-draft s draft-ietf-idwg-idmef-xml-11.txt
[4] Intrusion Detection Working Group.The intrusion detection exchange protocol (IDXP).2002.http : www.ietf.org internet-draf ts draft-ietf-idwgbeep-idxp-07.txt
[5] Prodromidi s AL, Chan PK.Meta-learning in distributed data mining systems:issues and approaches.In :Kargupta H, Chan P eds., Book onAdvances of Di stributed Data Mining.AAAI press, 2000
[6] Lee WK.A data mining framework for constructing f eatures and models for intrusion detection systems, [Ph.D.thesis].New York :ColumbiaUniversity, 1999
[7] Lian YF, Dai YX, Wang H.Anomaly detect ion of user behaviors based on profile mining.Chinese Journal of Computers, 2002, 25(3):325 ～ 330(in Chinese with Engli sh abstract)
[1] 连一峰, 戴英侠, 胡 艳.分布式入侵检测模型研究.计算机研究与发展, 2003, 40(8):1195 ～ 1202
[7] 连一峰, 戴英侠, 王 航.基于模式挖掘的用户行为异常检测.计算机学报, 2002, 25(3):325～ 330
/
| 〈 |
|
〉 |