Access multiplexer with remote intrusion detection capability

Abstract

The access multiplexer (DSLAM) according to the present invention combines a remote host-based intrusion detection system (RHIDS) to detect the Malicious behavior on a large number of access users; and finally a network-based intrusion detection system (NIDS2) is also incorporated to detect all access users connected to an access multiplexer by analyzing incoming and outgoing traffic for attack signature patterns (S21 , S22...S2N) malicious behavior.

Description

technical field [0001] The present invention relates to intrusion detection, which is the technique of detecting inappropriate, malicious, incorrect or abnormal behavior in a communication network. An intrusion can be any attack from the outside, and the detection of such an attack is usually based on statistical anomaly analysis and / or traffic pattern matching. The state of the art intrusion detection systems are such as host-based classical intrusion detection systems or network-based intrusion detection systems. Background technique [0002] A host-based intrusion detection system runs on a host to detect malicious behavior on that particular host. Typically, a host-based intrusion detector consists of software loaded on a monitored computer or host system to scan traffic to and from the computer, check the integrity of system files, and monitor suspicious processes. Host intrusion detection software can utilize all or selected system and user log files, and / or monitor ...

AI Technical Summary

Problems solved by technology

[0006] Known host-based intrusion detection systems, whether combined with network-based intrusion detection systems or not, run on a single host or a small number of hosts in a local area network, and therefore cannot detect anomalies in multiple operating systems

Moreover, this host-based intrusion detection system consumes CPU power and memory resources of the host, and is difficult to manage and upgrade.

Therefore, this known host-based intrusion detection system is very unsuitable for applications where there are a very large number of access subscribers (e.g. close to thousands of digital subscriber lines (DSLAM) connected to a single digital subscriber line access multiplexer (DSLAM). DSL) users) are used in the access network connected to an access multiplexer. Typically, these users run different operating systems on PCs

Images