Abstract
The intrusion detection inter-component adaptive negotiation (IDIAN) project has developed a negotiation protocol to allow a distributed collection of heterogeneous intrusion detection (ID) components to inter-operate and reach agreement on each other's ID information processing capabilities and needs. The negotiation, moreover, is dynamic, so the information generated and processed can evolve as the intrusion detection system (IDS) evolves and as the environment changes. This paper describes IDIAN extensions to the common intrusion specification language (viz., GIDO filters), the negotiation protocol itself, a load model used to measure computing load on a system due to the use of ID services, and a demonstration of the protocol.