Cell2














 Celll Cell3



 Figure 3.4 Cellular Architecture

 Having a mixture of near and far hosts implies that the messages sent between cell

members now go over several network segments before reaching their destination. This

may not be desirable in case the IDSes are configured to report a large number of events

to each other, and if the messages pass through routers with heavy traffic.

 Achieving the second goal implies that a functional grouping must be performed.

For example, a set of web servers can be grouped together. They can have specialized

detectors and response agents running on them. It would make more sense for them to

cooperate with each other, as they would experience similar kinds of attacks. Hence

deciding which hosts form neighbors is a tradeoff among survivability, message traffic,

and relevance of grouping.