page_title: ACARM-ng
section_title: Architecture
hierarchical_section_title: ACARM-ng / Architecture
caption_attribution_description: Overview of the ACARM-ng plugin architecture.
context_page_description: ACARM-ng is an open source IDS/IPS system. ACARM-ng is an alert correlation software which can significantly facilitate analyses of traffic in computer networks. It is responsible for collection and correlation of alerts sent by network and host sensors, also referred to as NIDS and HIDS respectively. Correlation process aims to reduce the total number of messages that need to be viewed by a system administrator to as few as possible by merging similar events into groups representing logical pieces of malicious activity.
context_section_description: ACARM-ng consists of 3 main elements: correlation daemon, WUI and (optional) a database engine.
  ACARM-ng's daemon has been designed from scratch as a framework solution. It provides core system functionalities, like logging, alerts and correlated meta-alerts passing between system parts, error recovery, multi-threading, etc.. The rest of the package are plug-ins, separated into following classes:
  persistency (data abstraction)
  input (data gathering)
  filter (data correlation and modification)
  trigger (automatic reporting and reaction)
  Built-in software watchdog provides up-to-date information on system status.
  WUI makes browsing of correlated data easy via graphical and tabular representation of gathered and correlated events. System administrator can easily see what is going on at every moment of system's lifetime.
  The WUI and the daemon interoperate through a database. Daemon stores gathered data along with the correlation results and its runtime configuration. WUI is entitled to read and display this data.
  Notice that even though data base engine is not required for running daemon, it is strongly recommended to save data persistently. Rejecting to use database makes it impossible to obtain system information via WUI and leads to a loss of historical data when system is restarted. Events that are no longer processed by the daemon are discarded as well.
caption: Internal architecture of ACARM-ng showing bundled plug-ins.
exif: {}