Abstract
Problem statement: Security Management has become a critical aspect for large scale distributed systems. Particularly, recent Distributed Intrusion Detection Systems (DIDS) schemes in High Speed Networks (HSN) have raised new serious management problems and challenges. Increasing the effectiveness of IDS monitoring is primordial to satisfy the restrictive constraints in such large multi-domains environment for narrow context of HSN. Approach: We consider the intrusion detection monitoring as a two facets entity: one at local level (single domain) and another at the global one (multi-domains). Through the local level, evolution of single domain intrusion detection process (vulnerability data collection, alert generation and sensor configuration according to some improvement scenarios) can be monitored. The global level represents evolution of multi-domain intrusion detection process as well as the eventual security defending process through overall network (policy generation, load balancing operations and global alert correlation). Differentiating these two facets, leads to the design of a scalable intrusion detection management solution. Results: The effectiveness of DIDS management in HSN had been studied and an IDS scalable monitoring architecture for multi-domains had been proposed. Several scenarios of Snort IDS showed an improvement on the performance of real-time detection. An integration of a set of tools provided a convivial IDS monitoring platform. Conclusion: To satisfy the constraints of Intrusion detection process in term of real-time and efficiency in HSN we need to monitor efficiently the IDS process. In this context, the management framework outlined is more appropriate, convenient and efficient. The herein proposed architecture, the snort IDS improvement techniques and the integrated platform played a crucial role in improving of IDS real-time monitoring.
Highlights
Between high speed networks and usual networks, the potentially huge number of packets evolved over time, the
Since the Distributed Intrusion Detection Systems (DIDS) process needs to share different types of files such that vulnerability report files, security policy rules, intrusion detection rules and attack alerts files and security reports about the network security status, Peer-to-Peer (P2P) technology which employs distributed resources to perform a critical function in a decentralized manner makes easy the exchange of these files and the sharing of the security information with other entities (Sallay, 2009)
We proposed several recommendations for the design of Intrusion Detection Systems (IDS) over High Speed Networks (HSN), starting from the communication protocol and the programming model that should be adopted, to the way the system should handle the communication flow, the memory management and the data transfer between IDS sensors
Summary
Between high speed networks and usual networks, the potentially huge number of packets evolved over time, the. Since the DIDS process needs to share different types of files such that vulnerability report files, security policy rules, intrusion detection rules and attack alerts files and security reports about the network security status, Peer-to-Peer (P2P) technology which employs distributed resources to perform a critical function in a decentralized manner makes easy the exchange of these files and the sharing. Sallay (2009), we designed and implemented a P2P platform dedicated to share different types of files such as vulnerability report files, security policy rules, intrusion detection rules, attack alerts files and security reports about the network security status, in a decentralized manner making easy the exchange of these files and the sharing of the security information involved by the DIDS process The solution is based on switch-based splitting approach that supports intrusion detection on high-speed links by balancing the traffic load among different sensors running Snort placed in each point of access to the Internet. Sallay (2009), we designed and implemented a P2P platform dedicated to share different types of files such as vulnerability report files, security policy rules, intrusion detection rules, attack alerts files and security reports about the network security status, in a decentralized manner making easy the exchange of these files and the sharing of the security information involved by the DIDS process
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
