RAAS: A reliable analyzer and archiver for snort intrusion detection system

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2007, Pages 259-263

  Soleimani, Mahboobeh ^a   Asl, Ehsan Khosrowshahi ^a   Doroud, Mina ^a   Damanafshan, Morteza ^a   Behzadi, Akbar ^a   Abbaspour, Maghsoud ^a,b  

^a INSTITUTE FOR STUDIES IN THEORETICAL PHYSICS AND MATHEMATICS IPM   (Iran)

^b SHAHID BEHESHTI UNIVERSITY   (Iran)

Author keywords

Archiving; IDS analyzer; Intrusion detection system; Snort

Indexed keywords

ADAPTIVE CONTROL SYSTEMS; ANALOG DIFFERENTIAL ANALYZERS; DATABASE SYSTEMS; QUERY PROCESSING; SERVERS;

ABSTRACTED FORMATS; MID RANGE SERVERS; RELIABLE ANALYZERS; SELF ADAPTIVE CONTROLLING MECHANISMS; SNORT INTRUSION DETECTION SYSTEMS;

INTRUSION DETECTION;

EID: 35248864777     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1244002.1244067     Document Type: Conference Paper

References (20)

1. Abdullah, K., Lee, C., Conti, G., Copeland, J., and Stasko, J. IDS RainStorm: Visualizing IDS Alarms. IEEE Symposium on Information Visualization's Workshop on Visualization for Computer Security (VizSEC), October 2005.
2. ACID: Managing Alert Databases, Available at http://acidlab. sourceforge.net/acid_archive_instruct.html.
3. Analysis Console for Intrusion Detection. Available at http://acidlab.sourceforge.net/. August 2006.
4. archivePlus script. Available at http://ntsug.org/downloads/ archivePlus.pl, August 2006.
5. Basic Analysis and Security Engine. Available at http://secureideas. sourceforge.net/ .August 2006.
6. Beale, J. and Foster, J. C. Snort 2.0 Intrusion Detection. Syngress Publishing, 2003.
7. Bellare, M., and Kohno, T. Hash Function Balance and Its Impact on Birthday Attacks. EUROCRYPT '04, - LNCS Vol. 3027, Springer-Verlag, 2004.
8. Cora, G. and Purdie, L. Comprehensive Event Log Monitoring, white paper by InterSect Alliance, 2003.
9. Deleting Old Alerts in MySqI Database. Available at http://www.snort. org/archive-5-1967.html, August 2006.
10. Hoagland J. A. and Stamford S. Viewing IDS Alerts: Lessons from SnortSnarf. In Proeedings of DARPA Information Survivability Conference and Ex- position, 2001.
11. Koike, H., Ohno, K. SnortView: visualization system of snort logs, In proceedings of the ACM workshop on Visualization and data mining for computer security, Washington DC, USA, pp. 143 - 147, 2004.
12. MySQL & ACID Issues, Available at http://www.mcabee.org/lists/ snort-users/Mar-03/msg00378.html, August 2006.
13. Rehman, R. U. Intrusion Detection Systems with Snort. Prentice Hall PTR Upper Saddle River, New Jersey, pp. 180-187, 2003.
14. th Usenix Systems and Administration Conference ( LISA'99), November 1999.
15. Schaelicke, L., Geiger, M. R., Freeland, C. J. Imporving the Database Logging Performance of the Snort Network Intrusion Detection Sensor. Technical Report 03-10, Department of Computer Science and Engineering University of Notre Dame, 2003.
16. Script to cleanup ACID/Snort Alerts in MySQL DB. Available at http://marc.theaimsgroup.com/?l=snort-users&m=104941480228554&w= 2, August 2006.
17. Snort Alerts Database Purging Script. Available at http://gaia.ecs. csus.edu/~bhatian/, August 2006.
18. Snort Forums Archive (BASE/ACID time out issue). Available at http://www.snort.org/archive-7-389.html. August 2006.
19. Snort IDS. Available at http://www.snort.org/. August 2006.
20. th Iranian Conference on Electrical Engineering (ICEE'06). Tehran, Iran. May 2006.