Distributed Intrusion Detection

• Host agent module – background process collects data and sends results to the central manager

• LAN monitor agent module – analyzes LAN traffic and sends results to the central manager

• Central manager module – processes and correlates received reports to detect intrusion