Computer Science – Cryptography and Security
Scientific paper
2008-04-08
WSEAS Transactions on Computers, 5(1), pp 186-193, 2006
Computer Science
Cryptography and Security
Scientific paper
Network intrusion detection sensors are usually built around low level models of network traffic. This means that their output is of a similarly low level and as a consequence, is difficult to analyze. Intrusion alert correlation is the task of automating some of this analysis by grouping related alerts together. Attack graphs provide an intuitive model for such analysis. Unfortunately alert flooding attacks can still cause a loss of service on sensors, and when performing attack graph correlation, there can be a large number of extraneous alerts included in the output graph. This obscures the fine structure of genuine attacks and makes them more difficult for human operators to discern. This paper explores modified correlation algorithms which attempt to minimize the impact of this attack.
Aickelin Uwe
Tedesco Gianni
No associations
LandOfFree
Data Reduction in Intrusion Alert Correlation does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.
If you have personal experience with Data Reduction in Intrusion Alert Correlation, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Data Reduction in Intrusion Alert Correlation will most certainly appreciate the feedback.
Profile ID: LFWR-SCP-O-540617