A novelty-driven approach to intrusion alert correlation based on distributed hash tables

Proceedings - IEEE Symposium on Computers and Communications

Volumn , Issue , 2007, Pages 71-78

  Hofmann, Alexander ^a   Dedinski, Ivan ^a   Sick, Bernhard ^a   De Meer, Hermann ^a  

^a UNIVERSITY OF PASSAU   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; COMPUTER SYSTEMS; DATA COMMUNICATION SYSTEMS; DATA STORAGE EQUIPMENT; HIERARCHICAL SYSTEMS; SECURITY OF DATA; SENSORS; SIGNAL DETECTION; TECHNICAL PRESENTATIONS; TELECOMMUNICATION NETWORKS; WEIGHT CONTROL;

CENTRAL COMPONENT; COMMUNICATION ARCHITECTURES; COMPUTER NETWORKS; CURRENT SYSTEMS; DATA COLLECTIONS; DETECTION AGENTS; DISTRIBUTED HASH TABLES; DISTRIBUTED INTRUSION DETECTION; DISTRIBUTED INTRUSION DETECTION SYSTEMS; INTERNATIONAL SYMPOSIUM; INTRUSION ALERT CORRELATION; INTRUSION DETECTION SYSTEMS; LOAD-BALANCED; NO REDUCTION; NOVELTY MEASURE; SELF-ORGANIZING; SINGLE POINT;

INTRUSION DETECTION;

EID: 48049102734     PISSN: 15301346     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISCC.2007.4381564     Document Type: Conference Paper

References (26)

1. A. Allen. Intrusion detection systems: Perspective. Technical report, Gartner Inc., 2003.
2. A. Andrzejak and Z. Xu. Scalable, efficient range queries for grid information services. p2p, 00:33-40, 2002.
3. S. Axelsson. Intrusion detection systems: A survey and taxonomy. Technical Report 99-15, Chalmers University of Technology, Department of Computer Engineering, 2000.
4. J. S. Balasubramaniyan, J. O. Garcia-Femandez, D. I. E. Spafford, and D. Zamboni. An architecture for intrusion detection using autonomous agents. In 14th Annual Computer Security Applications Conference, Scottsdale, pages 13-24, 1998.
5. I. Clarke, O. Sandberg, B. Wiley, and T. W. Hong. Freenet: a distributed anonymous information storage and retrieval system. In International Workshop on Designing Privacy Enhancing Technologies, New York, pages 46-66, 2001.
6. F. Cuppens. Managing alerts in a multi-intrusion detection environment. In Proceedings of the 17th Annual Computer Security Applications Conference (ACSAC 2001), New Orleans, pages 22-31, 2001.
7. H. Debar, D. Curry, and B. Feinstein. The intrusion detection message exchange format. http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml- 14.txt (last visited: 2006/08), June 2005. Internet-Draft, http://www.ietf.org/ internet-drafts/draft-ietf-idwg-idmef-xml-14.txt.
8. U. M. Fayyad, G. Piatetsky-Shapiro, and P. Smyth. Knowledge discovery and data mining: Towards a unifying framework. In Proceedings of The Second International Conference on Knowledge Discovery and Data Mining, Portland, pages 82-88, 1996.
9. R. Gopalakrishna and E. H. Spafford. A framework for distributed intrusion detection using interest driven cooperating agents. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection (RAID 2000): Toulouse, pages 54-68, 2001.
10. A. Hofmann, T. Horeis, and B. Sick. Feature selection for intrusion detection: An evolutionary approach. In IJCNN 2004: Proceedings of the IEEE-INNS-ENNS International Joint Conference on Neural Networks, Budapest, volume 2, pages 1563-1568, 2004.
11. D. J. Ingram, S. Kremer, and N. C. Rowe. Distributed intrusion detection for computer systems using communicating agents. In Proceedings of the 2000 Command and Control Research and Technology Symposium, Monterey, pages 27-42, 2000.
12. R. Janakiraman, M. Waldvogel, and Q. Zhang. Indra: A peer-to-peer approach to network intrusion detection andprevention. In Twelfth International Workshop on Enabling Technologies, Linz, pages 226-231, 2003.
13. W. Jansen, P. Meli, T. Karygiannis, and D. Marks. Applying mobile agents to intrusion detection and response. Technical Report 6416, National Institute of Standards and Technology, Computer Security Division, 1999.
14. Z. Li, Y. Chen, and A. Beach. Towards scalable and robust distributed intrusion alert fusion with good load balancing. In LSAD '06: Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense, Pisa, pages 115-122, 2006.
15. K. McGarry. A survey of interestingness measures for knowledge discovery. Knowledge Engineering Review, 20(1):39-61, 2005.
16. A. Rao, K. Lakshminarayanan, S. Surana, R. Karp, and I. Stoica. Load balancing in structured p2p systems. In Proceedings of the 2nd International Workshop on Peer-to-Peer Systems (IPTPS03), Berkeley, 2003.
17. M. Ripeanu. Peer-to-peer architecture case study: Gnutella network. In Proceedings of the First International Conference on Peer-to-Peer Computing, pages 99-100, 2001.
18. A. Rowstron and P. Druschel. Pastry: Scalable, distributed object location and routing for large-scale peer-to-peer systems. In IFIP/ACM International Conference on Distributed Systems Platforms (Middleware), pages 329-350, November 2001.
19. C. Severance, S. Pramanik, and P. Wolberg. Distributed linear hashing and parallel projection in main memory databases. In VLDB '90: Proceedings of the 16th International Conference on Very Large Data Bases, San Francisco, pages 674-682, 1990.
20. K. K. S.Teodiridis. Pattern recognition. Academic Press, 1998.
21. I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, and H. Balakrishnan. Chord: A scalable peer-to-peer lookup service for internet applications. In SIGCOMM '01: Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, San Diego, pages 149-160, 2001.
22. M. Treaster. A survey of distributed intrusion detection approaches. Technical Report CR/0501001, National Center for Supercomputing Applications (NCSA), 2005.
23. J. L. Undercoffer. Intrusion Detection: Modeling System State to Detect and Classify Anomalous Behaviors. PhD thesis, University of Maryland, Faculty of the Graduate School, 2004.
24. F. Valeur, G. Vigna, C. Kruegel, and R. A. Kemmerer. A comprehensive approach to intrusion detection alert correlation. IEEE Transactions on Dependable and Secure Computing, 1(3):146-169, 2004.
25. G. B. White, E. A. Fisch, and U. W. Pooch. Cooperating security managers: A peer based intrusion detection system. IEEE Network, 10(1):20-23, 1996.
26. V. Yegneswaran, P. Barford, and S. Jha. Global intrusion detection in the DOMINO overlay system. In 11th Annual Network and Distributed System Security Symposium (NDSS), San Diego, 2004.