Integrating intrusion detection and network management

The problems of detecting and resolving performance in distributed systems have become increasingly important and challenging due to the tremendous growth in network-based services. There is a need for a predictive and proactive approach so that appropriate and timely actions can be taken before service disruptions escalate and become widespread. A network management system (NMS) is responsible for monitoring the performance of a network. An intrusion detection system (IDS) is responsible for detecting and responding to intrusions. The current practice is that NMS and IDS are independent to each other in a network. There is little integration and information sharing between the two. We outline an approach to integrate NMS and IDS so that the security capabilities of network management can be enhanced and the performance of IDS can be improved.