Development of an Integrated Solution for Intrusion Detection: A Model Based on Data Correlation

This work describes a solution for intrusion detection that presents an improved operational efficacy - both in terms of performance as well as volume of processed data - reducing at the same time the number of false negative and false positive results. For that purpose we correlate the data collected by the intrusion detection system with other data sources, such as events that are reported by interfacing equipment (edge devices) as well as other agents considered crucial for this purpose such as vulnerability detection solutions. As part of the proposed solution the data is collected in a relational data base system, to facilitate data correlation, as well as making it available through an easy to use Web interface. Additionally, the system interacts with the network managers, in response to pre-defined triggers using a unified messaging platform that uses tools capable of processing e-mails, text messages and also an instant messaging tool based of the XMPP protocol