Designing and implementing a family of intrusion detection systems

TLDR

Intrusion detection systems analyze network events to detect malicious behavior using attack models, but their ad hoc development in heterogeneous environments increases effort as the number of protected systems grows. The authors created STAT, a modular framework designed to streamline the development of intrusion detection functionality across diverse environments. STAT extends intrusion detection systems through a well‑defined process that adds new attack‑modeling language components and adapts to specific platforms and event streams. The framework’s extension process yields a software family of IDS that share attack‑modeling features and can dynamically reconfigure their behavior.

Abstract

Intrusion detection systems are distributed applications that analyze the events in a networked system to identify malicious behavior. The analysis is performed using a number of attack models (or signatures) that are matched against a specific event stream. Intrusion detection systems may operate in heterogeneous environments, analyzing different types of event streams. Currently, intrusion detection systems and the corresponding attack modeling languages are developed following an ad hoc approach to match the characteristics of specific target environments. As the number of systems that have to be protected increases, this approach results in increased development effort. To overcome this limitation, we developed a framework, called STAT, that supports the development of new intrusion detection functionality in a modular fashion. The STAT framework can be extended following a well-defined process to implement intrusion detection systems tailored to specific environments, platforms, and event streams. The STAT framework is novel in the fact that the extension process also includes the extension of the attack modeling language. The resulting intrusion detection systems represent a software family whose members share common attack modeling features and the ability to reconfigure their behavior dynamically.