Creative Approaches Towards Development of Computing and Multidisciplinary IT Solutions for Society

2Enhancing Intrusion Detection Effectiveness Through an Enhanced Hierarchical Communication Architecture

Thu Nguyen Xuan^1*, Trang Ha Mai Huyen², Trung Tran³ and Ngoc Le Anh⁴

¹VNU University of Engineering and Technology, Hanoi, Vietnam

²Vietnam National University, Hanoi, Vietnam

³Electric Power University, Hanoi, Vietnam

⁴Swinburne Việt Nam, FPT University, Hanoi, Vietnam

Abstract

An intrusion detection system (IDS) is an effective proactive measure for protecting the security and integrity of information by identifying attacks before they can cause damage. damage to information systems. For large and mission-critical systems, the proposed solution involves building a collaborative IDS network to improve intrusion detection efficiency. When IDS A identifies suspicious behavior X, it sends an alert to the collaborating IDS, signaling the possibility of a large-scale attack and allowing proactive responses to be taken. However, challenges arise when attacks occur at multiple locations simultaneously, as simultaneous alert transmission from an IDS can increase network traffic, potentially overloading systems and causing bottleneck congestion. This study introduces an advanced hierarchical communication architecture that uses aggregation and clustering methods for preprocessing and cluster warning before transmission to the network. In this model, IDSs selectively share information only with their respective “parent” nodes. At “parent” nodes, alerts originating from child nodes ...