Distributed Instrusion Prevention in Active and Extensible Networks

Abstract

Abstract. The proliferation of computer viruses and Internet worms has had a major impact on the Internet Community. Cleanup and control of malicious software (malware) has become a key problem for network administrators. Effective techniques are now needed to protect networks against outbreaks of malware. Wire-speed firewalls have been widely deployed to limit the flow of traffic from untrusted domains. But these devices weakness resides in a limited ability to protect networks from infected machines on otherwise trusted networks.Progressive network administrators have been using an Intrusion Prevention System (IPS) to actively block the flow of malicious traffic. New types of active and extensible network systems that use both microprocessors and reconfigurable logic can perform wire-speed services in order to protect networks against computer virus and Internet worm propagation. This paper discusses a scalable system that makes use of automated worm detection and intrusion prevention to stop the spread of computer viruses and Internet worms using extensible hardware components distributed throughout a network. The contribution of this work is to present how to manage and configure large numbers of distributed and extensible IPSs.

DEIDtect

“…Snapp et al [15] demonstrated a prototype of Distributed IDS (DIDS) that combines distributed monitoring and data reduction with centralized data analysis (through the DIDS Director). A Distributed Intrusion Prevention System (DIPS) has been proposed by Sproull et al [16]. Our work is complementary to these approaches focusing on the flexible use of network and cloud resources across different domains to realize security functions in a distributed setting.…”

“…(This remains true in practice despite various earlier efforts towards distributed intrusion detection systems [5,7,16].) Specifically, while security professionals at different organizations readily exchange intelligence through personal communication, there is no systematic way to follow a lead to a remote location to investigate the potential source of an attack.…”

DFIPS: Toward Distributed Flexible Intrusion Prevention System in Software Defined Network

“…DEIDtect [23] is an elastic distributed intrusion detection framework that decouples the location of the protected network from IDS/IPS in the cloud and enterprise network. [24] shows the cooperation of active network management software and extensible hardware to stop an attack.…”