Centralized Orchestration for Agent-Based Host Intrusion Detection System with Threat Intelligence

Abstract

Cyber threats such as malware injection, web shell exploitation, phishing, and lateral movement increasingly challenge host-level security mechanisms. Conventional Host-Based Intrusion Detection Systems (HIDS) are commonly deployed in stand-alone configurations, resulting in limited cross-host visibility, delayed incident response, and lack of integration with external threat intelligence. This study proposes an agent-based HIDS architecture with centralized orchestration and real-time threat intelligence integration to improve detection accuracy and response efficiency. The system is developed using an experimental approach based on the NIST SP 800-61 Rev.2 incident handling framework, covering preparation, detection and analysis, containment and recovery, and post-incident evaluation. Each host deploys a lightweight agent that monitors file system activities, generates cryptographic hash values, and sends artifact metadata to a centralized orchestration server. The server performs parallel validation using external threat intelligence services and executes automated containment actions. Experimental results in a multi-host virtual environment show a False Positive Rate (FPR) of 3.2%, Mean Time to Detect (MTTD) of 4.8 seconds, and Mean Time to Respond (MTTR) of 6.5 seconds, with a 38% improvement compared to manual monitoring. These findings indicate that centralized orchestration combined with threat intelligence integration enhances detection precision, scalability, and incident response effectiveness in HIDS