Correlation of intrusion symptoms: An application of chronicles

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2820, Issue , 2003, Pages 94-112

  Morin, Benjamin ^a   Debar, Hervé ^a  

^a ORANGE LABS   (France)

Author keywords

[No Author keywords available]

Indexed keywords

HIGH LEVEL LANGUAGES; MERCURY (METAL);

CORRELATION COMPONENTS; DECLARATIVE LANGUAGES; RECOGNITION SYSTEMS;

INTRUSION DETECTION;

EID: 33646160004     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-45248-5_6     Document Type: Article

References (24)

1. B. Morin, L. Mé, H. Debar and M. Ducassé, "M2D2: a formal data model for intrusion alarm correlation", Proceedings of the 5th Recent Advances in Intrusion Detection 2002 (RAID2002), 2002.
2. S.T. Eckmann, G. Vigna, R.A. Kemmerer, "STATL: An Attack Language for State-based Intrusion Detection", Dept. of Computer Science, University of California, Santa Barbara, 2000.
3. M. Roger, J. Goubault-Larrecq, "Log Auditing Through Model-Checking", Proceedings of the 14th IEEE Computer Security Foundations Workshop (CSFW01), 2001.
4. U. Lindqvist, P.A. Porras, "Detecting Computer and Network Misuse Through the Production-Based Expert System Toolset (P-BEST)", Proceedings of the IEEE Symposium on Security and Privacy, 1999.
5. D.V. McDermott, "A Temporal Logic for Reasoning about Processes and Plans", Cognitive Science, pp.101-155, 1982.
6. F. Bacchus, J. Tenenberg, J.A. Koomen, "A non-reified Temporal Logic", Artificial Intelligence, pp.87-108, 1991.
7. J. Allen, "Towards a General Theory of Action and Time", Artificial Intelligence, pp.123-154, 1984.
8. H. Debar, A. Wespi, "Aggregation and Correlation of Intrusion Detection Alerts", Proceedings of the 4th Recent Advances in Intrusion Detection (RAID2001), October 2000.
9. S. Manganaris, M. Christensen, D. Zerkle, K. Hermiz, "A Data Mining Analysis of RTID Alarms", Computer Networks: The International Journal of Computer and Telecommunications Networking, Volume 34, Issue 34, October 2000.
10. C. Dousson, P. Gaborit, and M. Ghallab, "Situation Recognition: Representation and Algorithms", in proceedings of the 13th IJCAI, pp.166-172, August 1993.
11. C. Dousson, "Suivi d'évolutions et reconnaissance de chroniques", PhD Thesis, http://dli.rd.francetelecom.fr/abc/diagnostic/, 1994.
12. C. Dousson, "Alarm Driven Supervision for Telecommunication Networks: Online Chronicle Recognition", Annales des Telecommunications, pp.501-508, 1996.
13. C. Dousson, "Extending and Unifying Chronicles Representation with Event Counters", in proceedings of the 15th European Conference on Artificial Intelligence (ECAI 2002), August 2002.
14. M. O. Cordier, C. Dousson, "Alarm Driven Monitoring Based on Chronicles", in proceedings of the 4th Symposium on Fault Detection Supervision and Safety for Technical Processes (Safeprocess 2000), pp. 286-291, June 2000.
15. H. Debar, M.Y. Huang, D.J. Donahoo, "Intrusion Detection Exchange Format Data Model", IETF Draft, 2002.
16. Y. Shoham, "Temporal Logics in AI: Semantical and Ontological Considerations", Journal of Artificial Intelligence, pp.89-104, 1987.
17. R. Dechter, I. Meiri, J. Pearl, "Temporal Constraint Networks", Artificial Intelligence, pp.61-95, 1991.
18. G. Jakobson and M. D. Weissman, "Alarm correlation", IEEE Network Magazine, pp. 52-60, 1993.
19. K. Julisch, "Mining Alarm Clusters to Improve Alarm Handling Efficiency", Proceedings of the 17th ACSAC, December 2001.
20. S. Manganaris, et al, "A Data Mining Analysis of RTID Alarms", First International Workshop on the Recent Advances in Intrusion Detection (RAID98), September 1998.
21. J.P. Pouzol, M. Ducassé, "From Declarative Signatures to Misuse IDS", Proceedings of the 4th Recent Advances in Intrusion Detection (RAID), 2001.
22. J.P. Pouzol, M. Ducasse, "Formal Specification of Intrusion Signatures and Detection Rules", Proceedings of the 15th IEEE Computer Security Foundations Workshop (CSFW), 2002.
23. F. Cuppens, "Managing Alerts in Multi-Intrusion Detection Environment", Proceedings of the 17th Annual Computer Security Applications Conference (ACSAC 01), 2001.
24. F. Cuppens, A. Miege, "Alert Correlation in a Cooperative Intrusion Detection Framework", Proceedings of the IEEE Symposium on Security and Privacy", 2002.