A Generic Architecture for Fusion-Based Intrusion Detection Systems
Remco C. de Boer · 2002
Contents Acknowledgments ix 1 Introduction 1 2 Intrusion Detection Systems 5 2.1 Information Security . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2 Intrusion Detection and its Problems . . . . . . . . . . . . . . . 7 2.3 Cooperating IDSs . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.3.1 Interoperability . . . . . . . . . . . . . . . . . . . . . . . 10 2.3.2 Intelligent Attack Analysis and Data Fusion . . . . . . 11 2.4 Evaluation and Thesis Goal . . . . . . . . . . . . . . . . . . . . 15 2.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 3 Multisensor Data Fusion 19 3.1 History of Multisensor Data Fusion . . . . . . . . . . . . . . . . 19 3.2 The JDL Functional Data Fusion Process Model . . . . . . . . 20 3.3 Antony's Biologically Motivated Fusion Process Model . . . . . 24 3.4 Data Fusion Architectures . . . . . . . . . . . . . . . . . . . . . 26 3.5 Development of a Data Fusion System . . . . . . . . . . . . . . 29 v vi CONTENTS 3.6 Summ