Intelligence, not integration: Distributed regret minimization for IDS Control

Abstract

We present an empirical study of regret minimization procedure used in a distributed Intrusion Detection System (IDS) to independently adapt the self-contained components of the system without any explicit coordination. We show that the regret minimization methods can be used to build survivable distributed security systems that can only communicate using standard data-transfer protocols (NetFlow, selective traffic mirroring or alerts) and do not need to rely on explicit communication required by more elaborate coordination protocols. The intended impact is dramatically easier integration, maintenance and repair of IDS systems, with only a small impact on system characteristics.