A Layered Framework for Placement of Distributed Intrusion Detection Devices

Network based distributed intrusion detection is a common trend in several commercial intrusion detection systems. However, network based intrusion detection requires that a security officer comprehends the dynamic and non-deterministic nature of data traffic across the network. This paper provides security officers with a brief introduction to intrusion detection techniques and classifications. The paper, then, proposes a framework for placement of distributed intrusion detection devices along its four layers: the network perimeter, the high sensitivity network components, the location of data and applications, and traffic analysis. The following sections will discuss intrusion detection and the proposed layered approach in greater detail.