A major research problem in intrusion detection is the efficient Detection of coordinated attacks over large networks. Issues to be resolved include determining what data should be collected, which portion of the data should be analyzed, where the analysis of the data should take place, and how to correlate multi-source information. This paper proposes the architecture of a Coordinated Attack Response & Detection System (CARDS). CARDS uses a signature-based model for resolving these issues. It consists of signature managers, monitors, and directory services. The system collects data in a flexible, distributed manner, and the detection process is decentralized among various monitors and is event-driven. The paper also discusses related implementation issues.
Yang et al. REF proposed a scheme called Coordinated Attack Response and Detection Systems (CARDS), that uses a signature-based model for resolving issues.
Cards: A Distributed System For Detecting Coordinated Attacks
IFIP TC11 Sixteenth Annual Working Conference on Information Security
Computer Science