A New Approach for IDS Composition

This paper presents a new approach for dynamic composition of Intrusion Detection Systems (IDSs). In this approach, the dynamic composition is used for building more flexible and adequate IDSs to open distributed systems. Intrusion detection systems are built on components or monolithic systems for creating more complex and cooperative intrusion detection systems that work as unified structures. Our approach can be applied in medium and large sized systems, for either closed or open networks. In order to provide the necessary scalability and flexibility, this approach is based on a service-oriented architecture (SOA). The IDSs are composed by using services founded on the XML language and Web Services technology. These technologies are being used with their security extensions on the data communications and the security events notifications. This paper presents the basic framework features, emphasizing the components search, selection, composition and communication.