Correlation and Pattern Matching - IDS Sensors and Log Gatherers create a large number of security related events which may be caused by serious attacks on the network. This stream of events needs to be analyzed and refined by technical means, as manual processing is far to complex and time consuming. Correlation and pattern matching can be used to infer from related events that specific attack scenarios have been carried out on the protected network.

Attack Graph Workflow - Gathering information, constructing an Attack Graph, as well as visualizing and analyzing the graph are the three steps of the workflow. Improving the different phases of the workflow as well as combining the workflow with IDS is a research topic at HPI.

IDS Management - Efficient Intrusion Detection System Management (IDSM) is an important capability for distributed IDS solutions, which makes it possible to integrate and handle different types of sensors or collect and synthesize alerts generated from multiple hosts in a distributed environment. Improving the efficiency of IDS Management is a research goal at HPI.

Virtualization and IDS - The concept of virtualization has been introduced into many popular IDS implementations, due to the advantage on isolation and fast recovery in case of being compromised as well as its applicability in emerging concepts, such as Cloud Computing. Advancing the capabilities for combining these newly emerged Virtual Machine (VM) based IDS approaches is another research topic at HPI.

IDS in the Cloud - The concept of Cloud computing yields multiple unsovled security problems. Securing a Cloud infrastrcuture using IDS Sensors and management is one of the research topics focused in this project.

Visualization and Collaboration - Visualizing the correlation results and the security-relevant events in general is essential for an effective defense of sophisticated attacks. Visualizating results and collaboration in security operations is a focus in this research project.