Host 1 Host 2
 Rule Rule
 Base Base

 4 11

 Rule Base Parser Rule Base Parser

 S 3 12 10
 Response 6 Response 13
 Server Coordinator Server Coordinator
 2
 7 I 9


 Communicator D Communicator





 Figure 3.3 Inter-Host Communication


 The heartbeat also acts as the timing agent of the system. It can be easily

configured to send out periodic messages for events that are supposed to occur at certain

intervals. One example is the request for knowledge (events occurring on other hosts).

Certain special hosts on the network that are called knowledge stores use this message to

trigger a knowledge request event that results in event digests being downloaded from

neighboring knowledge stores. Another example would be a periodic self-check message.

This can be used to fire of a response agent that performs integrity checks on the IDS

itself. Periodic log file backups can also be triggered by the heartbeat. Hence, the

heartbeat can be compared to the cron daemon on UNIX systems [17].

 3.3 Division into Cells

 The previous section described the extended GIDEM architecture and mentioned

that it is advantageous to install the core modules on every host of the system. This

section describes a way to arrange the distributed IDS system into cells, for improving