Title:  Fusion and Filtering in Distributed Intrusion Detection Systems

Abstract:

False alarms and timely identification of new attacks are two of the
biggest challenges to the effective use of network intrusion detection
systems (NIDS).  A potential means for addressing these shortcomings in
modern NIDS is employing multiple, distributed network intrusion detection
systems (DNIDS).  In this paper we consider the potential benefits of DNIDS
by addressing two open problems.  The first problem is how to combine data
from multiple intrusion sensors in a network.  This is known as the
information fusion problem.  The second problem is to reduce noise in
observed traffic using observations from multiple sensors, which is known
as the filtering problem.  We develop a series of analytic models to assess
the potential benefits of DNIDS for reducing false alarms and improving
timeliness of detection for different fusion and filtering algorithms.  Our
analysis explores the trade-offs when fusion and filtering are used
together and shows that significant improvements are possible.