Moving Towards an Adaptive Enterprise Intrusion Detection and Prevention System

In this paper, we describe our plans to create a smarter network defense system through the collection and analysis of network signatures generated by real security threats. To meet this goal, we plan to create software agents interconnected to a central behavior analysis database service where each software agent records attack meta-information collected during previous intrusion attempts. The central database warehouses and analyzes the meta-information collected by the interconnected agents. The agents can then utilize both instantaneous and historical data by integrating rules derived from the data collection and analysis process into intrusion prevention policies. The result is a modular and scalable network defense system that should be more responsive and adaptable to imminent threats.