| Intrusion Detection (ID) aims to recognise malicious activities in the monitored system, through the analysis of massive quantities of data (audit data, log files, network packets, flows). In particular, in the past few year there has been an increasing interest in ID for IP networks, in order to provide a secure network environment and services. The first phase of ID saw 10/100Mbps networks as protagonists: the wire speed permitted a deep inspection of all the traffic, as well as the amount of data allowed the researchers to consider payload based analysis methodologies. Nowadays, this scenario is not exhaustive anymore. This PhD project, in front of the the spread of 1-10Gbps technology and the offer of new on-line services, faces the necessity of developing systems that can cope with the always increasing network speed and quantity of data to be analysed. The most promising approach to this problem is in our opinion the use of aggregated network information, as it is with flow-based techniques. At the same time, this PhD project also aims to address the problem of adaptability in high-speed networks, i.e. self-learning solutions that permit a fast reconfiguration of the system in order to recognise new threats and reduce the need of human interaction. |
