Decentralized publish-subscribe system to prevent coordinated attacks via alert correlation

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3269, Issue , 2004, Pages 223-235

  Garcia, Joaquin ^a   Autrel, Fabien ^b   Borrell, Joan ^a   Castillo, Sergio ^a   Cuppens, Frederic ^c   Navarro, Guillermo ^a  

^a UNIVERSITAT AUTÒNOMA DE BARCELONA   (Spain)

^b ONERA   (France)

^c ECOLE DES MINES DE NANTES   (France)

Author keywords

Alert Correlation; Intrusion Detection; Publish Subscribe Systems

Indexed keywords

DISTRIBUTED COMPUTER SYSTEMS; INTRUSION DETECTION; NETWORK ARCHITECTURE; OPEN SOURCE SOFTWARE;

ALERT CORRELATION; COOPERATIVE SCHEMES; COORDINATED ATTACK; DECENTRALIZED ARCHITECTURE; NETWORK RESOURCE; PUBLISH-SUBSCRIBE SYSTEMS; SECURE MULTICASTS; THIRD PARTIES;

MESSAGE PASSING;

EID: 35048819574     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-30191-2_18     Document Type: Article

References (16)

1. D. Andersson, M. Fong, and A. Valdes. Heterogeneous sensor correlation: A case study of live traffic analysis. In 3rd Annual Information Assurance Workshop, United States Military Academy, West Point, New York, USA, June 2002.
2. S. Benferhat, F. Autrel, and F. Cuppens. Enhanced correlation in an intrusion detection process. In Mathematical Methods, Models and Architecture for Computer Network Security (MMM-ACNS 2003), St Petersburg, Russia, September 2003.
3. F. Cuppens. Managing alerts in a multi-intrusion detection environment. In 17th Annual Computer Security Applications Conference (ACSAC'01), New Orleans, Lousiana, December 2001.
4. F. Cuppens, F. Autrel, A. Miège, and S. Benferhat. Recognizing malicious intention in an intrusion detection process. In Second International Conference on Hybrid Intelligent Systems (HIS'2002), Santiago, Chile, October 2002.
5. F. Cuppens and A. Miège. Alert correlation in a cooperative intrusion detection framework. In IEEE Symposium on Security and Privacy, Oakland, USA, 2002.
6. F. Cuppens and R. Ortalo. LAMBDA: A language to model a database for detection of attacks. In Third International Workshop on the Recent Advances in Intrusion Detection (RAID'2000), Toulouse, France, 2000.
7. D. Curry, H. Debar, and B. Feinstein. Intrusion detection message exchange format data model and extensible markup language (xml) document type definition. Internet draft, January 2004.
8. D. Garlan, S. Khersonsky, and J. S. Kim. Model checking publish-subscribe systems. In Proceedings of the 10th International SPIN Workshop, Portland, Oregon, USA, May, 2003.
9. K. Julich. Using root cause analysis to handle intrusion detection alarms. ACM journal name, 2:111-136, October 2002.
10. C. Kruegel. Network Alertness - Towards an adaptive, collaborating Intrusion Detection System. PhD thesis, Technical University of Vienna, June 2002.
11. C. Kruegel and T. Toth. Flexible, mobile agent based intrusion detection for dynamic networks. In European Wireless, Italy, February 2002.
12. B. Morin, L. Mé, H. Debar, and M. Ducassé. M2D2: a formal data model for intrusion alarm correlation. In Proceedings of the 5th Recent Advances in Intrusion Detection (RAID2002), Zurich, Switzerland, October 2002.
13. P. Ning, Y. Cui, and D. S. Reeves. Analyzing intensive intrusion alerts via correlation. In Fifth International Symposium on Recent Advances in Intrusion Detection (RAID2002), pages 74-94, Zurich, Switzerland, October 2002.
14. P. A. Porras and P. G. Neumann. EMERALD: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of the 20th National Information Systems Security Conference, pages 353-365, October 1997.
15. B. Segall and D. Arnold. Elvin has left the building: A publish/subscribe notification service with quenching. In Proceedings of the third annual technical conference of AUUG 1997, pages 243-255, Brisbane, September 1997.
16. S. R. Snapp, J. Brentano, G. V. Dias, T. L. Goan, L. T. Heberlein, C. Ho, K. N. Levitt, B. Mukherjee, S. E. Smaha, T. Grance, D. M. Teal, and D. Mansur. DIDS (distributed intrusion detection system) - motivation, architecture and an early prototype. In Proceedings 14th National Security Conference, pages 167-176, October, 1991.