Distributed exchange of alerts for the detection of coordinated attacks

Abstract

Attacks and intrusionsto informationsystems cause large revenue losses. The prevention of these attacks is not always possible by just considering information from isolated sources of the network. A global view of the whole system is necessary to react against the different actions of such an attack. The design and deploymentof a decentralized system targeted at detecting as well as reacting to informationsystem attacks might benefit from the use of the publish/subscribemodel. In this paper, we discussthe advantages and conveniencein usingthis com- munication paradigm for a general decentralized attack preventionframework and overview the designand imple- mentationof our approach by using a combinationof two different publish/subscribemiddleware products. Further- more, wepresentaquantitativeevaluationofourapproach.