Synapse: auto-correlation and dynamic attack redirection in an immunologically-inspired IDS

Intrusion detection systems (IDS) perform an important role in the provision of network security, providing real- time notification of attacks in progress. One promising category of IDS attempts to incorporate into its design properties found in the natural immune system. Although previous attempts to apply immunology to intrusion detection have considered the issue of accuracy, more work still needs to be done. We present an immunologically-inspired intrusion detection model in which the false positive rate is moderated through a process of event correlation between multiple sensors. In addition, the model offers a novel response mechanism. Previous research has flirted with a variety of response mechanisms, including those that are capable of tearing down connections, killing processes and dynamically updating firewall rules. Although such mechanisms may prevent or at least mitigate an attack before its full impact is achieved, they work against the collection of information for inv...

• Type: Conference
• Year: 2006
• Where: ACSW
• Authors: David Duncombe, George M. Mohay, Andrew Clark
• Keywords: ACSW 2006, ACSW 2007, Intrusion Detection, Intrusion Detection Systems, Response Mechanisms