Operator-Centric and Adaptive Intrusion Detection

9 years 4 months ago
Operator-Centric and Adaptive Intrusion Detection
: An intrusion detection system should support the operator of the system. Thus, in addition to producing alerts, it should allow for easy insertion of new detection algorithms. It should also support dynamic selection and de-selection of detection algorithms, and it should adjust its resource consumption to the current need. Such a system would allow the operator to easily extend the system when new detection algorithms become available. It would also allow the operator to maintain a low-cost monitoring baseline and perform more extensive monitoring when it is required. In this paper, we propose an architecture for intrusion detection that aims at providing the operator with this support. The architecture uses a modular design to promote a high degree of flexibility. This supports creation of an environment in which state-of-the-art intrusion detection algorithms easily can be inserted. The modular design also allows for detection algorithms to be enabled and disabled when required. A...
Ulf Larson, Stefan Lindskog, Dennis K. Nilsson, Er
Added 31 May 2010
Updated 31 May 2010
Type Conference
Year 2008
Authors Ulf Larson, Stefan Lindskog, Dennis K. Nilsson, Erland Jonsson
Comments (0)