The network intrusion-detection concept is extended from the LAN (local area network) environment to arbitrarily wider areas, with the network topology being arbitrary as well. The generalized distributed environment is heterogeneous, i.e. the network nodes can be hosts or servers from different vendors, or some of them could be LAN managers. The proposed architecture for this distributed intrusion-detection system consists of the following components: a host manager (namely a monitoring process or collection of processes running in background) in each host: LAN manager for monitoring each LAN in the system; and a central manager, placed at a single secure location, that receives reports from various host and LAN managers and processes these reports, correlates them, and detects intrusions. >