Browse > Article

A Detection Rule Exchange Mechanism for the Collaborative Intrusion Detection in Defense-ESM  

Lee, Yun-Hwan (공군본부 중앙전산소)
Lee, Soo-Jin (국방대학교 국방정보체계)
Publication Information
Convergence Security Journal / v.11, no.1, 2011 , pp. 57-69 More about this Journal
Abstract
Many heterogeneous Intrusion Detection Systems(IDSs) based in misuse detection technique including the self-developed IDS are now operating in Defense-ESM(Enterprise Security Management System). IDS based on misuse detection may have different capability in the intrusion detection process according to the frequency and quality of its signature update. This makes the integration and collaboration with other IDSs more difficult. In this paper, with the purpose of creating the proper foundation for integration and collaboration between heterogeneous IDSs being operated in Defense-ESM, we propose an effective mechanism that can enable one IDS to propagate its new detection rules to other IDSs and receive updated rules from others. We also prove the performance of rule exchange and application possibility to defense environment through the implementation and experiment.
Keywords
Defense-ESM; Security; Intrusion Detection System; Rule Exchange; Integration and Collaboration;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Steven T. Eckman, "Translating Snort rules to STATL scenarios", Reliable Software Group Department of Computer Science University of California, In Proc. Recent Advances in Intrusion Detection, 2001
2 Clifford Kahn, Don Bolinger, Dan Schnakenberg, "Communication in the Common Intrusion Detection Framework v0.7", CIDF Working Group, 1998. 6
3 윤현철, "에이전트 기반의 침입탐지시스템 분석", 국방과학연구소, 2002.9
4 IETF, IDWG, "Intrusion Detection Message Exchange Protocol (IDXP)", draft-ietf-idwg-beep-idxp-07, 2002.10
5 Adam Wierzbicki, Jacek Kalinski, Tomasz Kruszona, "CIDSS : Common Intrusion Detection Signature Standard", Polish-Japanese Institute of Information Technology
6 IETF Intrusion Detection Workking Group, "Common Intrusion Detection Signature Standard", Reference http://tools.ietf.org, 2009.3