Architecture of distributed intrusion detection system based on anomalies

The designed architecture of intrusion detection system uses a two-layer hybrid model for detecting intrusions. The system processes network flows in real communication operation and provides processing of these data in real time. First layer consists of detection sensors which provide basic processing of input data based on statistical methods with a direct connection to countermeasure modules. Performance and accuracy of the designed system is ensured with central distributed processing, in which the detection of generalized description of partial ordered events is used, preventing the intrusion itself. By this the attack variability of the same type are provided.