An agent-based framework for intrusion detection alert verification and event correlation

International Journal of Security and Networks

Volumn 3, Issue 3, 2008, Pages 193-200

  Uphoff, Benjamin ^a   Wong, Johnny S ^b  

^a LOS ALAMOS NATIONAL LABORATORY   (United States)

^b Iowa State University   (United States)

Author keywords

Alert correlation; Alert verification; Broker; Event correlation; IDS; Intrusion detection system; Software agents; Web service

Indexed keywords

APPLICATION PROGRAMS; HETEROGENEOUS NETWORKS; INTRUSION DETECTION; VERIFICATION; WEB SERVICES; WEBSITES;

ALERT CORRELATION; ALERT VERIFICATION; BROKER; EVENT CORRELATION; INTRUSION DETECTION SYSTEMS;

SOFTWARE AGENTS;

EID: 72549101766     PISSN: 17478405     EISSN: 17478413     Source Type: Journal    
DOI: 10.1504/IJSN.2008.020093     Document Type: Article

References (4)

1. Cuppens, F. and Miege, A. (2002) 'Alert correlation in a cooperative intrusion detection framework', Proceedings of the 2002 IEEE Symposium on Security and Privacy, November, Oakland, CA, pp. 202-209.
2. Ning, P., Cui, Y. and Reeves, D.S. (2002) 'Constructing attacks scenarios through correlations of intrusion alerts', Proceedings of the 9th ACM Conference on Computer and Communications Security, November, Washington DC, pp. 245-254.
3. Valdes, A. and Skinner, K. (2001) 'Probabilistic alert correlation', Proceedings of the International Workshop on Recent Advances in Intrusion Detection, October 2001, Davis, CA, pp. 54-68.
4. Valeur, F., Vigna, G., Kruegel, C. and Kemmerer, R.A. (2004) 'A comprehensive approach to intrusion detection alert correlation', IEEE Transactions on Dependable and Secure Computing, Vol. 1, No. 3, July September, pp. 146-169.