Luo Xucheng

Cost-based intelligent intrusion detection and response: design and implement

A flexible intrusion detection and response system (ID&R) needs to maximize security while minimizing cost and making response automatically. CI/sup 2/D&R, the cost-based intelligent intrusion detection and response system, is proposed, which is originally developed as a facility to deal with network-based attacks and to make effective response automatically and intelligently. The networking environment deployed with the CI/sup 2/D&R consists of two major parts: guard, which runs on the specific guarded host (GH), and spy, which runs in guarded network (GN). The components of the CI/sup 2/D&R are introduced, which include intrusion detection, attack classification, damage analysis, attack path rebuilding, resources automatically safeguarding, calamity recovery, and security officer. The several kinds of data flow in CI/sup 2/D&R are discussed, too. While CI/sup 2/&R is only a prototype, some experimental results are also presented.

CI 2 D&R: Cost-based Intelligent Intrusion Detection and Response System

Intrusion detection and response system (ID&R) need to maximize security while minimizing cost and taking response automatically. CI/sup 2/D&R, the Cost-based Intelligent Intrusion Detection and Response System, is originally developed as facilities for deal with network-based attacks automatically and intelligently. This paper provides an overview of CI/sup 2/D&R architecture. The primary components of CI/sup 2/D&R and their functions are also probed into. What is more, the data flow of CI/sup 2/D&R is discussed and compared. Finally, the related work is touched on and conclusions are drawn.