DIDS
Written by Vyga V R Sunday, 28 March 2010 08:18
A distributed IDS consists of multiple intrusion detection systems over a large network, all of which communicate with each other, or with a central server that facilitates advanced network, monitoring, incident analysis, and instant attack data. The two main components of distributed IDS are
The Central Analysis Server.
The central analysis server is really the heart and soul of the operation. This server usually consists of a database and Web server. The web interface provided by the Web server allows the corporate users to see the current attack status of their network. It also allows analysts to perform pre programmed queries, such as attack aggregation, statistics gathering and to perform rudimentary incident analysis, all from a web interface.
The Co-operative Agent Network.
The co-operative agent network is one of the most important components of the DIDS. An agent is a piece of software that reports attack information to the central analysis server. By having these co-operative agents distributed across a network, incident analysts and security personnel are able to get a broader view of what is occurring on their network as a whole. Ideally these agents will be located on separate network segments, and geographical locations. The agents can also be distributed across multiple physical locations, allowing for a single incident analysis team to view attack data across multiple corporate locations.
| < Prev | Next > |
|---|