Intrusion detection relies on the information provided by a number of sensors deployed throughout the monitored network infrastructure. Sensors provide information at different abstraction levels and
with different semantics. In addition, sensors range from lightweight probes and simple log parsers to complex software artifacts
that perform sophisticated analysis. Managing a configuration of heterogeneous sensors can be a very time-consuming task.
Management tasks include planning, deployment, initial configuration, and run-time modifications. This paper describes a new
approach that leverages off the STAT model to support a highly configurable sensing infrastructure. The approach relies on
a common sensor model, an explicit representation of sensor component characteristics and dependencies, and a shared communication
and control infrastructure. The model allows an Intrusion Detection Administrator to express high-level configuration requirements
that are mapped automatically to a detailed deployment and/or reconfiguration plan. This approach supports automation of the
administrator tasks and better assurance of the effectiveness and consistency of the deployed sensing infrastructure.
Keywords Security - Software Engineering - Intrusion Detection - STAT