A Multi-Layered Approach to the Design of Intelligent Intrusion Detection and Prevention System (IIDPS)

Abstract

Ignoring security threats can have serious consequences; therefore host machines in network must continually be monitored for intrusions since they are the final endpoint of any network.As a result, this paper presents an Intelligent Intrusion Detection and Prevention System (IIDPS), which monitors a single host system from three different layers; files analyzer, system resource and connection layers. The approach introduced, a multi -layered approach, in which each layer harnesses both aspects of existing approach, signature and anomaly approaches, to achieve a better detection and prevention capabilities. The design of IIDPS consist of three basic components; the iExecutive which is an agent that runs in the background, iBaseline which is a database that stores the signatures of intrusions and the iManager which is a user Interface that serves as an intermediary between the IIDPS and the user.This work serves as a foundation upon which interested researchers can further build on to achieve better detection and prevention capabilities.

A Study of the Novel Approaches Used in Intrusion Detection and Prevention Systems

“…A well trained staff and analyst are required to continuously monitoring the system. Still a huge effort is required to construct new security strategies which are discussed in [6], [7], [8].…”

“…Reference [6] Provides a multilayer approach in IDS to monitor a single host. Multilayer approach [6] consists of three layers.…”

“…Multilayer approach [6] consists of three layers. File analyzer monitors the particular files and folders on the host system that could be under attack by intruders.…”

“…The advantage of this technique is that it provides both signatures based and anomaly based detection and protects the system against harmful attacks. Multilayer approach [6] in IDS requires a large amount of memory to store the data of the system and network traffic. IDS should have to continuously update the system whenever it detects any intrusion.…”

“…It requires a large amount of memory to store all the collected information about intruder. But still this tool does not provide enough and strongest security to an organization as the technique discussed in [6], [9]. This paper [14] proposed architecture to protect host-based intrusion system through virtual machine.…”