Infrastructure for intrusion detection and response

An overview of the intruder detection and isolation protocol (IDIP) architecture and how it supports the need for an intrusion detection and response infrastructure is provided.

Abstract

Automated response to intrusions has become a major issue in defending critical systems. Because the adversary can take actions at computer speeds, systems need the capability to react without human intervention. An infrastructure that supports development of automated response systems is critically needed. This infrastructure must allow easy integration of detection and response components to enable experimentation with automated response strategies. This paper provides an overview of the intruder detection and isolation protocol (IDIP) architecture and how it supports the need for an intrusion detection and response infrastructure.