Modeling a distributed intrusion detection system using collaborative building blocks

Developing complex distributed systems is a non-trivial task. It is even more difficult when the systems need to dynamically reconfigure the distributed functionalities or tasks. Not only do we need to deal with the application-specific functionalities that are intricate, but we also have to handle the complex logic of coordinating the distribution and relocation of tasks. In this paper, we model an intrusion detection system that distributes its analysis units to a number of hosts and assigns fine-grained analysis tasks to these hosts in order to cope with the rapid increase of audit data from today’s IT systems. The system is further capable to react to overload situations and to shift tasks to other hosts. To develop this complex system, we apply the model-based engineering method SPACE. In particular, we show that the collaborative specification style of the method can significantly reduce the development effort. Also, the formal semantics of SPACE ensures the correctness ...

• Type: Journal
• Year: 2011
• Where: SIGSOFT
• Authors: Linda Ariani Gunawan, Michael Vogel, Frank Alexander Kraemer, Sebastian Schmerl, Vidar Slåtten, Peter Herrmann, Hartmut König
• Keywords: Complex Distributed Systems, Intrusion Detection System, Model-based Engineering Method, SIGSOFT 2011, Software Engineering