An auto-configuration cooperative distributed intrusion detection system

To overcome some problems related to current intrusion detection system (IDS), such as high false negative and false positive rate, complex configuration, high cost and the inability to cooperate among components in the system, the authors propose a distributed IDS prototype. The system consisted of control centers, proxies and sensors. In conjunction, the authors also propose a special communication protocol, CDIDSTP for the transparent communication between control centers and sensors via proxy. Combining carefully designed sensors and modulated IDS functions, an effective, highly auto-configurable IDS was implemented. In addition, the modulated IDS functions made the cooperation of similar functional components within sensor possible.