Harman Patil (Editor)

ACARM (software)

Updated on
Share on FacebookTweet on TwitterShare on LinkedInShare on Reddit
Developer(s)  WCSS
Development status  discontinued
Initial release  2008.04.01
Written in  Java
ACARM (software)

Original author(s)  BartÅ‚omiej Balcerek Bartosz Szurgot Wojciech Waga Marcin Wojtkiewicz
Stable release  0.1.0 / October 5, 2009 (2009-10-05)

ACARM (Alert Correlation, Assessment and Reaction Module) is an open source intrusion detection system. It was developed as a part of POSITIF project between 2004 and 2007. It was written as a practical proof of concept, presented in the article.

Filters architecture

The following image shows chain-like architecture for filters, as used in the system.

Each alert enters each filter, stays there for a specified amount of time and proceeds further in chain. Main issue with such an approach is that alter can be reported only after its processing is done, which in turn takes at least few minutes.


ACARM (software) Wikipedia