IDS/A: An Interface between Intrusion Detection System and Application

We describe a number of problems which may reduce the effectiveness of a conventional network intrusion detection system. These problems are the result of the IDS having to second-guess the components or applications it is protecting. We propose a bi-directional interface between IDS and application. Applications use this interface to describe their state and submit their actions for approval to the IDS. The IDS thus receives information first-hand and is able to block suspect actions immediately. Apart from eliminating some of the abovementioned problems, the interface may also make it possible to extend the uses of intrusion detection systems to such tasks as gradual, continuous authentication and automated least privilege enforcement.