Intrusion Detection Management System for eCommerce Security
Jorge Marx Gómez, Jens Lichtenberg · Journal of Information Privacy and Security · 2007
This paper introduces the idea of an intrusion detection management system to enhance the security of eCommerce systems. An Intrusion Management System applies different Intrusion Detection Systems (IDS) to not only detect a threat but also analyze it and propose counter measures to avoid compromising the guarded system. Numerous intrusion detection systems, using different techniques are linked to an attack analyzer. The attack analyzer gathers the information from n different IDS within the system and diagnoses a treatment plan. The system administrator or a response planning module aiding the administrator can also query the analyzer for information about the attack character, possible goals and the impending threat level. For the treatment plan, depending on the analysis, a multitude of counter measures is identified and ranked. The counter measure identification is done using data mining techniques on a counter measure repository, the final ranking through sorting algorithms. A feasibility study has shown that an analyzer can match a problem against a solution repository and find the optimal treatment suggestions, applied with a ranking, in an acceptable short period of time.