An Intrusion Detection and Response Cooperation Model Based on XML Message Exchange
Xiaomei Dong, Guang Xiang, Yu Ge · Journal of the Association for Information Systems · 2004
In a distributed intrusion detection system, multiple detection components are usually applied to monitor different hosts and network resources.The components sometimes need to cooperate with one another to perform complex detection tasks.However, the heterogeneity of the detection components greatly increases the complexity of the cooperation among the components.Therefore, a more general and efficient intrusion detection cooperation mechanism is required.Considering XML's advantages in data representation and platform independence, we proposed in this paper a distributed intrusion detection and response cooperation model based on XML message exchange.In our model, cooperation agents correlate the detection results from the detection agents and cooperation agents of other domains to detect complex intrusions.To facilitate the communication between different components, the Intrusion Detection Message Exchange Format (IDMEF) is extended and applied to represent the messages exchanged among the intrusion detection components.In addition, cooperation agents cooperate with one another by exchanging XML messages.In the model, a schema is defined to constrain the XML documents.A new concept of suspect is proposed, which indicates the suspected degree of an activity.And all the suspected activities and intrusions detected are reported to the monitors for isolation and monitoring.