M.: Selective and early threat detection in large networked systems

Abstract—The complexity of modern networked information systems, as well as all the defense-in-depth best practices, require distributed intrusion detection architectures relying on the cooperation of multiple components. Similar solutions cause a multiplication of alerts, thus increasing the time needed for alert management and hiding the few critical alerts as needles in a hay stack. We propose an innovative distributed architecture for intrusion detection that is able to provide system administrators with selective and early security warnings. This architecture is suitable to large networks composed of several departments because it leverages hierarchical and peer-to-peer cooperation schemes among distributed NIDSes. Moreover, it embeds a distributed alert ranking system that makes it possible to evaluate the real level of risk represented by a security alert generated by a NIDS, and it allows independent network departments to exchange early warnings about critical threats. These features allow a system administrator to focus on the few alerts that represent a real threat for the controlled infrastructure and to be informed about the most dangerous intrusion(s) before his department is attacked. Keywords-Alert ranking; early warning; intrusion detection systems; distributed IDS; I