A framework for intrusion detection in heterogeneous environments

Abstract

In this paper we introduce the framework of a novel Service-oriented and User-centric Intrusion Detection System (SUIDS). It is proposed to protect ubiquitous computing environments like a smart home/office. Existing Intrusion Detection Systems (IDSs) fail to cope with such a highly heterogeneous and flexible environment due to their homogeneous system design and ineffective auditing mechanisms. Featuring a novel auditing mechanism and system architecture, SUIDS can effectively detect malicious activities of inside users. Specifically, the paper shows how network nodes are classified in order to accommodate different types of detection modules; how service specific knowledge and user profiles are used to audit users' activities and protect various networked appliances against intrusions; and how a user-centric approach is used to compose a dynamic 'defense wall' or 'quarantine' against malicious users. As a result, intrusion detection in our SUIDS is more reliable and resource-effective, with a lightweight, adaptive and heterogeneous system design. © 2005 IEEE.