PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks

The increase in scale of cyber networks and the rise sophistication cyber-attacks have introduced several challenges intrusion detection. primary challenge is requirement to detect complex multi-stage attacks realtime by processing immense amount traffic produced present-day networks. In this paper we present PRISM, a hierarchical detection architecture that uses novel attacker behavior model-based sampling technique minimize overhead. PRISM has unique multi-layered monitors network distributedly provide efficiency modularity design. employs Hidden Markov Model-based prediction mechanism identify ascertain attack progression for proactive response. Furthermore, introduces stream management procedure rectifies issue alert reordering when collected from distributed reporting systems. To evaluate performance multiple metrics been proposed, various experiments conducted on dataset. results exhibit up 7.5x improvement overhead as compared standard centralized IDS without loss accuracy while demonstrating ability predict different stages promptly.