Introduction

• Intrusion detection systems (IDS) detect attempted or successful misuse of computer systems

• CIDF component model [CIDF98]
  • Event generators (E-boxes)
  • Event analyzers (A-boxes)
  • Event databases (D-boxes)
  • Response units (R-boxes)