Control and estimation methods in information assurance - a tutorial on intrusion detection systems

Intrusion detection systems (IDSs) are relatively complex devices that monitor information systems in search for security violations or attacks. Following a presentation of the motivation, origins and the main elements of intrusion detection, IDSs are reviewed from a systems and control viewpoint, and four increasingly complex problems are identified: (1) off -line IDS; (2) off-line IDS with Bayesian cost models; (3) real time IDS with Bayesian and temporal cost models; and (4) real time IDS with feedback. The relevant literature on the four problems is surveyed. While most of the research efforts so far have been concentrated on the detection problems associated with off-line IDSs, recent challenges such as overload attacks against the IDS are now motivating researches on real time systems.