Security architecture based on multilayer distributed intrusion detection system

The architecture of designed intrusion detection system is based on two layer hybrid model for event detection. System function is based on analysis parts of network flow in a real communication and offers processing of this data in a real time. The core of the first layer are detection sensors, which offer base processing based on statistical methods with direct interconnection to countermeasure module. Performance and accuracy of designed system is secured with central distributed processing, in which is used detection based on particular event description, which foregoing intrusion. The architecture presented in this article is a result of teamwork of Department of computer and informatics and Institute of computer technologies of Technical University of Kosice. Its partial results are processed in author´s master thesis and research within the APPV-0073-07 project.