Alarm clustering for intrusion detection systems in computer networks

Engineering Applications of Artificial Intelligence

Volumn 19, Issue 4, 2006, Pages 429-438

  Perdisci, Roberto ^a   Giacinto, Giorgio ^a   Roli, Fabio ^a  

^a UNIVERSITY OF CAGLIARI   (Italy)

Author keywords

Alarm clustering; Computer security; Intrusion detection

Indexed keywords

ALARM SYSTEMS; COMPUTER CRIME; COMPUTER NETWORKS; CYBERNETICS; INFORMATION USE; SENSORS;

ALARM CLUSTERING; CYBERATTACKS; INTRUSION DETECTION;

SECURITY OF DATA;

EID: 33646037321     PISSN: 09521976     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.engappai.2006.01.003     Document Type: Article

References (23)

1. Axelsson, S., 2000. A preliminary attempt to apply detection and estimation theory to intrusion detection. Technical Report, Department of Computer Engineering, Chalmers University of Technology, Sweden, March.
2. Bass T. Intrusion detection systems and multisensor data fusion. Communications of the ACM 43 4 (2000) 99-105
3. Cuppens, F., 2001. Managing alerts in a multi-intrusion detection environment. Proceedings of the 17th Computer Security Applications Conference, ACSAC 2001, pp. 22-31.
4. Cuppens F., and Miege A. Alert correlation in a cooperative intrusion detection framework. Proceedings of the IEEE Symposium on Security and Privacy (2002) 202-215
5. Curry, D., Debar, H., Feinstein, B., 2004. The intrusion detection message exchange format 〈http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-11.txt 〉.
6. Giacinto G., Perdisci R., and Roli F. Alarm clustering for intrusion detection systems in computer networks. In: Perner P., and Imiya A. (Eds). Machine Learning and Data Mining in Pattern Recognition, MLDM 2005 (2005), Springer, Berlin 184-193
7. Goldman R.P., Heimerdinger W., Harp S.A., Geib C.W., Thomas V., and Carter R.L. Information modeling for intrusion report aggregation. Proceedings of the DARPA Information Survivability Conference Exposition II, DISCEX 2001 vol. 1 (2001) 329-342
8. Haines, J., Ryder, D.K., Tinnel, L., Taylor, S., 2003. Validation of sensor alert correlators. IEEE Security Privacy, January-February 2003, pp. 46-56.
9. ISS, Inc. RealSecure intrusion detection system 〈http://www.iss.net 〉.
10. Jain A.K., Murty M.N., and Flynn P.J. Data clustering: a review. ACM Computing Surveys 31 3 (1999) 264-323
11. Julish K. Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security 6 4 (2003) 443-471
12. Kendall, K., 1999. A database of computer attacks for the evaluation of intrusion detection systems. Master's Thesis, MIT.
13. Kruegel, C., Valeur, F., Vigna, G., 2005. Intrusion detection and correlation. Advances in Information Security Series, vol. 14. Springer, Berlin.
14. Lippmann R., Haines J.W., Fried D.J., Korba J., and Das K. The 1999 DARPA off-line intrusion detection evaluation. Computer Networks 34 4 (2000) 579-595 (Special issue on recent advances in intrusion detection systems)
15. McHugh J. Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Transaction on Information and System Security 3 4 (2000) 262-294
16. Porras, P.A., Fong, M.W., Valdes, A., 2002. A mission-impact-based approach to INFOSEC alarm correlation. In: Wespi, A., Vigna, G., Deri, L. (Eds.), Fifth International Symposium on Recent Advances in Intrusion Detection RAID 2002. Lecture Notes in Computer Science, vol. 2516. Springer, Berlin, pp. 95-114.
17. Prelude Intrusion Detection System 〈http://www.prelude-ids.org 〉.
18. Snort, Lightweight Intrusion Detection for Networks 〈http://www.snort.org 〉.
19. Sy B. Signature-based approach for intrusion detection. In: Perner P., and Imiya A. (Eds). Machine Learning and Data Mining in Pattern Recognition, MLDM 2005 (2005), Springer, Berlin 526-536
20. Symantec Network Security 7100 Series 〈http://enterprisesecurity.symantec.com 〉.
21. Undercoffer, J., Joshi, A., Pinkston, J., 2003. Modeling computer attacks: an ontology for intrusion detection. In: Vigna, G., Jonsson, E., Kruegel, C. (Eds.), Sixth International Symposium on Recent Advances in Intrusion Detection, RAID 2003. Lecture Notes in Computer Science, vol. 2820. Springer, Berlin, pp. 113-135.
22. Valdes, A., Skinner, K., 2001. Probabilistic alert correlation. In: Jonsson, E., Valdes, A., Almgren, M. (Eds.), Fourth International Symposium on Recent Advances in Intrusion Detection, RAID 2001. Lecture Notes in Computer Science, vol. 3224. Springer, Berlin, pp. 54-68.
23. Valeur F., Vigna G., Kruegel C., and Kemmerer R.A. Comprehensive approach to intrusion detection alert correlation. IEEE Transactions on Dependable and Secure Computing 1 3 (2004) 146-169