Distributed intrusion detection system based on data fusion method

Intrusion detection system (IDS) plays a critical role in information security because it provides the last line protection for those protected hosts or networks when intruders elude the first line. In this paper, we present a novel distributed intrusion detection system, which uses the Dempster-Shafer's theory of evidence to fuse local information. Our approach is composed of 2 layers: the lower layer consists of both host and network based sensors, which are specifically designed to collect local features and make local decisions to differentiate those easy-to-detect attacks; the upper layer is a fusion control center, it makes global decisions on those locally uncertain events by adopting Dempster's combination rule. Our approach gains the advantages of both host and network based intrusion methods, and can practice both rule-based and anomaly detection. A simulation is carried out and result shows that the multi-sensor data fusion model performs much better than single sensor.