The Human Factor - Adding Intelligence and Action to Intrusion Detection

Intrusion detection systems need to communicate with analysts on multiple levels. They need to be scaleable, reliable, effective, and efficient; in addition, they need to be responsive to human intelligence and intuition. To be safe from attack themselves, they need to be invisible to hackers. This paper explores the current state of Intrusion Detection Systems (IDS) technology with its roots dating from 1985. It identifies system requirements and essential elements in the context of an overall architecture; and it highlights several systems, available today, that fit nicely into the suggested architecture. The future of IDS will be much like its past. Technology will continue to evolve, attacks will become more difficult to detect, and humans will be needed more than ever.