Fusion and Filtering in Distributed Intrusion Detection Systems

False alarms and timely identification of new attacks are two of the biggest challenges to the effective use of network intrusion detection systems (NIDS). A potential means for addressing these shortcomings in modern NIDS is employing multiple, distributed network intrusion detection systems (DNIDS). In this paper we consider the potential benefits of DNIDS by addressing two open problems. The first problem is how to combine data from multiple intrusion sensors in a network. This is known as the fusion problem. The second problem is how to identify the most important data provided by multiple sensors in a network. This is known as the filtering problem