Distributed Intrusion Detection Scalability Issues

• Too much overhead for standalone IDS on each host

• Heterogeneous environment – different audit records

• Need IDS across the network

• Centralized vs decentralized issues