Operator-Centric and Adaptive Intrusion Detection

: An intrusion detection system should support the operator of the system. Thus, in addition to producing alerts, it should allow for easy insertion of new detection algorithms. It should also support dynamic selection and de-selection of detection algorithms, and it should adjust its resource consumption to the current need. Such a system would allow the operator to easily extend the system when new detection algorithms become available. It would also allow the operator to maintain a low-cost monitoring baseline and perform more extensive monitoring when it is required. In this paper, we propose an architecture for intrusion detection that aims at providing the operator with this support. The architecture uses a modular design to promote a high degree of flexibility. This supports creation of an environment in which state-of-the-art intrusion detection algorithms easily can be inserted. The modular design also allows for detection algorithms to be enabled and disabled when required. A...

• Type: Conference
• Year: 2008
• Where: IEEEIAS
• Authors: Ulf Larson, Stefan Lindskog, Dennis K. Nilsson, Erland Jonsson
• Keywords: Detection Algorithm, IEEEIAS 2008, Information Technology, Intrusion Detection, Intrusion Detection System