Extracting attack knowledge using principal-subordinate consequence tagging case grammar and alerts semantic networks

Proceedings - Conference on Local Computer Networks, LCN

Volumn , Issue , 2004, Pages 110-117

  Yan, Wei ^a   Hou, Edwin ^a   Ansari, Nirwan ^a  

^a NEW JERSEY INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DENIAL OF SERVICES; PRINCIPAL-SUBORDINATE; PROBABILISTIC APPROACHES; SEMANTIC NETWORKS;

CORRELATION METHODS; NETWORK PROTOCOLS; PROBLEM SOLVING; SECURITY OF DATA; SYSTEMS ANALYSIS; TELECOMMUNICATION NETWORKS;

SEMANTICS;

EID: 20544433820     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. D. Andersson, M. Fong, and A. Valdes, "Heterogeneous Sensor Correlation: A Case Study of Live Traffic Analysis," Proceedings of IEEE Information Assurance Workshop (United States Military Academy, West Point, NY, June 2002).
2. K. Church, "Word association norms, mutual information, and lexicography," Computational Linguistics, Vol. 16, No. 1, pp. 22-29, 1990.
3. W. Cook, Case Grammar Theory, Washington, DC: Georgetown University Press, 1989.
4. D. Curry, and H. Debar, "Intrusion Detection Message Exchange Format," http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-03. txt.
5. O. M. Dain and R. K. Cunningham, "Building Scenarios from a Heterogeneous Alert Stream," Proceedings of IEEE Workshop on Information Assurance and Security (United States Military Academy, West Point, NY, June 2001).
6. C. J. Fillmore, "The Case for Case Reopened." Studies in Syntax and Semantics, 8, 59-81, 1977.
7. C. W. Geib, and R. P. Goldman, "Plan recognition in intrusion detection systems," DARPA Information Survivability Conference, vol. 1, pp. 46-55, 2001.
8. J. M. Lucassen and R. L. Mercer, "An information theoretic approach to the automatic determination of phonemic baseforms," Proceedings of ICASSP, Vol.3, pp. 42.5.1-42.5.4, 1984.
9. W. Martin and P. Sterkenburg, Processing of text corpus, Lexicography: Principles and Practice, R. Hartmann, New York, 1983, pp. 56-64.
10. N. Peng, C. Yun, and S. R. Douglas, "Constructing Attack Scenarios through Correlation of Intrusion Alerts," Proceedings of the 9th ACM Conference on Computer & Communications Security, pp. 245-254, 2002.
11. F. Smadja, "Retrieving collocations from text: Xtract," Computational Linguistics, Vol 19, No. 1, pp.143-177, 1993.
12. A. Valdes, and K. Skinner, "Probabilistic alert correlation," Workshop on Recent Advances in Intrusion Detection, pp. 54-68, 2001.
13. L. Vanderwende, "The analysis of noun sequences using semantic information extracted from on-line dictionaries," Ph.D. dissertation, Georgetown University, Washington, DC., 1996.
14. http://www.ll.mit.edu/IST/ideval/data/2000/LLS_DDOS_1.0. html
15. http://www.snort.org