Alert correlation in a cooperative intrusion detection framework

Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy

Volumn , Issue , 2002, Pages 202-215

  Cuppens, Frédéric ^a   Miège, Alexandre ^a  

^a ONERA   (France)

Author keywords

Alert correlation; Alert merging; Cooperative intrusion detection; IDMEF

Indexed keywords

COMPUTER NETWORKS; COMPUTER SUPPORTED COOPERATIVE WORK; CORRELATION METHODS; MERGING;

ALERT CORRELATION; ALERT MERGING; CLUSTERING FUNCTIONS; COOPERATIVE INTRUSION DETECTION; INTRUSION DETECTION SYSTEMS;

SECURITY OF DATA;

EID: 0036079912     PISSN: 10637109     EISSN: None     Source Type: Journal    
DOI: 10.1109/SECPRI.2002.1004372     Document Type: Article

References (15)

1. E-trust intrusion detection
2. Intrusion detection message exchange format data model and extensible markup language (XML) document type definition
3. Managing alerts in a multi-intrusion detection environment
4. LAMBDA: A language to model a database for detection of attacks
5. The intrusion-detection console correlation mechanism
6. A large-scale distributed intrusion detection framework based on attack strategy analysis
7. A database of computer attacks for the evaluation of intrusion detection systems
8. Combining knowledge discovery and knowledge engineering to build IDSs
9. Using key string and neural networks to reduce false alarms and detect new attacks with sniffer-based intrusion detection systems
10. Adele: An attack description language for knowledge-based intrusion detection
11. Snort - Lightweight intrusion detection for networks
12. Probabilistic alert correlation
13. CARDS: A distributed system for detecting coordinated attacks
14. A data-mining analysis of RTID