A Case for Network-wide Orchestration of Host-based Intrusion Detection and Response
Fuente:
arXiv
Guardado en:
| Autores principales: | , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866913783681646592 |
|---|---|
| author | Timmons, Mark Lukaszewski, Daniel Xie, Geoffrey |
| author_facet | Timmons, Mark Lukaszewski, Daniel Xie, Geoffrey |
| contents | Recent cyber incidents and the push for zero trust security underscore the necessity of monitoring host-level events. However, current host-level intrusion detection systems (IDS) lack the ability to correlate alerts and coordinate a network-wide response in real time. Motivated by advances in system-level extensions free of rebooting and network-wide orchestration of host actions, we propose using a central IDS orchestrator to remotely program the logic of each host IDS and collect the alerts generated in real time. In this paper, we make arguments for such a system concept and provide a high level design of the main system components. Furthermore, we have developed a system prototype and evaluated it using two experimental scenarios rooted from real-world attacks. The evaluation results show that the host-based IDS orchestration system is able to defend against the attacks effectively. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2504_06241 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | A Case for Network-wide Orchestration of Host-based Intrusion Detection and Response Timmons, Mark Lukaszewski, Daniel Xie, Geoffrey Cryptography and Security Networking and Internet Architecture Recent cyber incidents and the push for zero trust security underscore the necessity of monitoring host-level events. However, current host-level intrusion detection systems (IDS) lack the ability to correlate alerts and coordinate a network-wide response in real time. Motivated by advances in system-level extensions free of rebooting and network-wide orchestration of host actions, we propose using a central IDS orchestrator to remotely program the logic of each host IDS and collect the alerts generated in real time. In this paper, we make arguments for such a system concept and provide a high level design of the main system components. Furthermore, we have developed a system prototype and evaluated it using two experimental scenarios rooted from real-world attacks. The evaluation results show that the host-based IDS orchestration system is able to defend against the attacks effectively. |
| title | A Case for Network-wide Orchestration of Host-based Intrusion Detection and Response |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2504.06241 |