Requirements of Information Reductions for Cooperating Intrusion Detection Agents

Abstract. We consider cooperating intrusion detection agents that limit the cooperation information flow with a focus on privacy and confidentiality. Generalizing our previous work on privacy respecting intrusion detection for centralized systems we propose an extended functional model for information reductions that is used for cooperation between intrusion detection agents. The reductions have the following goals: detective effectiveness of cooperation alliances, privacy of honest individuals, further organizational confidentiality requirements, and efficiency. For the reductions we outline the basic requirements, and derive the specific requirements imposed by the cooperation methods used for intrusion detection. It is shown, how our existing solutions could be adapted and what restrictions apply.

• Type: Conference
• Year: 2006
• Where: ETRICS
• Authors: Ulrich Flegel, Joachim Biskup
• Keywords: ETRICS 2006, Intrusion Detection, Intrusion Detection Agents, Privacy Respecting Intrusion, Security Privacy