Alarm reduction and correlation in defence of IP networks

Proceedings of the Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, WETICE

Volumn 13, Issue , 2004, Pages 229-234

  Chyssler, Tobias ^a   Nadjm Tehrani, Simin ^a   Burschka, Stefan ^b   Burbeck, Kalle ^a  

^a LINKÖPING UNIVERSITY   (Sweden)

^b Software and Security Technologies   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

CORRELATION AGENTS; HUMAN-MACHINE INTERFACE (HMI); INFORMATION SECURITY (INFOSEC) SYSTEMS; LARGE COMPLEX CRITICAL INFRASTRUCTURES (LCCI);

ALARM SYSTEMS; COMPUTER ARCHITECTURE; CORRELATION METHODS; ENERGY MANAGEMENT; HUMAN COMPUTER INTERACTION; NETWORK PROTOCOLS; SECURITY OF DATA; SOFTWARE AGENTS; USER INTERFACES;

INTERNET;

EID: 10444228269     PISSN: 15244547     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (17)

1. Yegneswaran, V., P. Barford and J. Ullrich. "Internet intrusions: global characteristics and prevalence", In Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, San Diego, CA, USA, pp. 138-147, 9-14 June 2003.
2. McHugh, J. "Intrusion and intrusion detection", International Journal of Information Security, Vol. 1, No 1, pp. 14-35, August 2001.
3. "Safeguard", 2003, http://www.ist-safeguard.org/. Accessed 3rd May, 2004.
4. Heckerman, D. A Tutorial on Learning With Bayesian Networks (MSR-TR-95-06). Microsoft Research, 1995.
5. Sima, J. Introduction to neural networks (V-755). ICS CAS, Prague, 1998.
6. Devroye, L., L. Gyorfi and G. Lugosi. A Probabilistic Theory of Pattern Recognition, Springer, New York, 1996.
7. Cuppens, F. and A. Miége. "Alert Correlation in a Cooperative Intrusion Detection Framework", In Proceedings of the 2002 IEEE Symposium on Security and Privacy, Berkeley, CA, USA, pp. 187-200, May 2002.
8. Debar, H. and A. Wespi. "Aggregation and Correlation of Intrusion-Detection Alerts", In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection, Davis, CA, USA, pp. 85-103, October 2001.
9. Ning, P., Y. Cui and D. S. Reeves. "Constructing attack scenarios through correlation of intrusion alerts", In Proceedings of the 9th ACM conference on Computer and communications security, Washington, DC, USA, pp. 245-254, 2002.
10. Morin, B. and H. Debar. "Correlation of Intrusion Symptoms: an Application of Chronicles", In Proceedings of the 6th symposium on Recent Advances in Intrusion Detection, Pittsburg, PA, USA, pp. 94-112, September 2003.
11. Porras, P. A., M. W. Fong and A. Valdes. "A Mission-Impact-Based Approach to INFOSEC Alarm Correlation", In Proceedings of the 5th symposium on Recent Advances in Intrusion Detection, Zurich, Switzerland, pp. 95-114, October 2002.
12. Qin, X. and W. Lee. "Statistical Causality Analysis of INFOSEC Alert Data", In Proceedings of the 6th symposium on Recent Advances in Intrusion Detection, Pittsburg, PA, USA, pp. 73-93, September 2003.
13. Valdes, A. and K. Skinner. "Probabilistic Alert Correlation", In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection, Davis, CA, USA, pp. 54-68, October 2001.
14. Julisch, K. and M. Dacier. "Mining Intrusion Alarms for Actionable Knowledge", In Proceedings of the 8th ACM SIGKDD international conference on Know-ledge discovery and data mining, Edmonton, Alberta, Canada, pp. 366 - 375, July 2002.
15. Chyssler, T. Reducing False Alarm Rates in Intrusion Detection Systems, Master thesis, Dissertation No. LITH-IDA-EX-03/067-SE, Linköpings universitet, 2003.
16. Burbeck, K., S. G. Andres, S. Nadjm-Tehrani, M. Semling and T. Dagonnier. "Time as a Metric for Defence in Survivable Networks", In Proceedings of the Work in Progress session of 24th IEEE Real-Time Systems Symposium (RTSS 2003), 2003.
17. "DARPA Cyber Panel program", 2003, http://ia.dc.teknowledee.com/CyP/, Accessed 28th April, 2004.