Towards Survivable Intrusion Detection

An intruder may target the ID scheme first in order to facilitate further malicious activities. For an intrusion-detection system that is operating in real time, an intruder could be exposed if they were simply to disable the IDS, a denial-of-service attack. A corrupted intrusion-detection system, however, might report erroneous information or fail to identify an attack. The consequences could be more serious if intrusion detection were conducted on a network-wide scale, as in the case of network surveillance demanded by system survivability. In such an environment, detection of coordinated attacks relies on information supplied by local intrusion-detection entities distributed across the network [10][13]. An attack targeting a selected set of intrusion-detection components could render the entire network intrusion-detection system ineffective.