Investigating the Benefits of Using Multiple Intrusion-Detection Sensors

Most intrusion detection systems (IDSs) available today are using a single audit source for detection,even though attacks have distinct manifestations in different parts of the system. Previously,we have explored the benefits of combining several sensors monitoring different audit sources toimprove the detection of attacks. In this paper we go one step further and investigate possible synergeticeffects by actively sharing information between distinct intrusion detection sensors takingevents from isolated audit sources. We present four scenarios where we show how the function ofone IDS, measured as false alarm rate, performance in terms of used resources, or attack response,can be improved by having access to information collected and analyzed by another IDS. Based onthese four scenarios, we then generalize our findings and outline necessary properties of a sensorcommunication framework for multiple IDSs. Our focus is on cooperation between IDSs, but wealso touch on response techniques