Secure Distributed IDSes Based on Separation of Execution Environments

Due to the nature that a distributed IDS has to monitor the whole distributed system, the IDSes constructing a distributed IDS are scattered throughout hosts in the distributed system. In addition, each IDS is embedded into a host and a network in the distributed system. As such, the distributed IDSes are not separated from the distributed system and therefore cause a security problem. A distributed IDS can be compromised via the distributed system. In this paper, we propose a virtual distributed environment called the HyperSpector, which is separated from the rest of a distributed system. The HyperSpector consists of virtual machines called the portspaces and a VPN. The portspace enables an IDS in it to monitor file systems, a network, and processes of servers running in the outside of it. Using the HyperSpector, a distributed IDS is protected from active attacks and damages by passive attacks are confined inside the HyperSpector.