A Distributed and Privacy-Preserving Method for Network Intrusion Detection

International audienceOrganizations security becomes increasingly more difficultto obtain due to the fact that information technology and networkingresources are dispersed across organizations. Network intrusion attacksare more and more difficult to detect even if the most sophisticatedsecurity tools are used. To address this problem, researchers and vendorshave proposed alert correlation, an analysis process that takes the eventsproduced by the monitoring components and produces compact reportson the security status of the organization under monitoring. Centralizedsolutions imply to gather from distributed resources by a third partythe global state of the network in order to evaluate risks of attacks butneglect the honest but curious behaviors. In this paper, we focus on thisissue and propose a set of solutions able to give a coarse or a fine grainglobal state depending on the system needs and on the privacy levelrequested by the involved organizations