Alert confidence fusion in intrusion detection systems with extended dempster-shafer theory

Proceedings of the Annual Southeast Conference

Volumn 2, Issue , 2005, Pages 2142-2147

  Yu, Dong ^a   Frincke, Deborah ^b  

^a University of Idaho   (United States)

^b UNIVERSITY OF IDAHO   (United States)

Author keywords

Alert confidence fusion; Alert correlation; Dempster Shafer Theory of Evidence; Hidden Colored Petri Net; Intrusion detection system

Indexed keywords

ALERT CORRELATION; BELIEF AND PLAUSIBILITY; CERTAIN HYPOTHESIS; COLORED PETRI NET; DATA SETS; DEMILITARIZED ZONES; DEMPSTER-SHAFER; DEMPSTER-SHAFER THEORY; DEMPSTER-SHAFER THEORY OF EVIDENCE; DETECTION RATES; DS THEORY; FALSE POSITIVE RATES; FUSION ALGORITHMS; INTRUSION DETECTION SYSTEMS; KEY FACTORS; QUANTITATIVE MEASUREMENT; SUBNETWORKS; THEORY OF EVIDENCE; UNCERTAINTY AND IGNORANCE;

COMPUTER CRIME; FORMAL LOGIC; MACHINERY; UNCERTAINTY ANALYSIS;

INTRUSION DETECTION;

EID: 77953769194     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1167253.1167289     Document Type: Conference Paper

References (21)

1. J. Allen, A. Christie, W. Fithen, J. McHugh, J. Pickel, and E. Stoner, State of the Practice of Intrusion Detection Technologies, Technical Report CMU/SEI-99-TR-028, 1999.
2. J.P Anderson, Computer Security Threat Monitoring and Surveillance, Technical report, James P Anderson Co., Fort Washington, Pennsylvania, April 1980.
3. J. Burroughs, L. F. Wilson and George V. Analysis of Distributed Intrusion Detection Systems Using Bayesian Methods, presented at IPCCC 2002, April 2002.
4. T. Bass, Intrusion detection systems and multisensor data fusion, Communications of the ACM, v.43 n.4, p.99-105, April 2000.
5. V. Berk, R. Gray, and G. Bakos, Using sensor networks and data fusion for early detection of active worms, Proc. of 2003 SPIE Aerosense Conference, Orlando, FL, April, 2003.
6. A. Berger, S. Della Pietra, & V. Della Pietra, A Maximum Entropy Approach to Natural Language Processing, Computational Linguistics, 22(1):39-71, 1996.
7. F. Cuppens, A. Miège, Alert Correlation in a Cooperative Intrusion Detection Framework, 2002 IEEE Symposium on Security and Privacy, May 12 - 15, 2002.
8. J. N. Darroch, & D. Ratcliff, Generalized iterative scaling for log-linear models, The Annals of Mathematical Statistics, 43(5), 1470-1480, 1972.
9. D. Frincke, Balancing Cooperation and Risk in Intrusion Detection, ACM Transactions on Information and System Security (TISSEC) 3(1): 1-29 (2000).
10. D. L. Hall, Mathematical Techniques in Multisensor Data Fusion, Artech House, Inc., Norwood, MA, 1992.
11. M.-Y. Huang, and T. M. Wicks, A Large-scale Distributed Intrusion Detection Framework Based on Attack Strategy Analysis, Web proceedings of the First International Workshop on Recent Advances in Intrusion Detection (RAID'98), 1998.
12. G. Jiang and G. Cybenko, Temporal and Spatial Distributed Event Correlation for Network Security, 2004 American Control Conference, Boston, June 30 - July 3.
13. J. Kohlas and P. Monney. Theory of evidence - a survey of its mathematical foundations, applications and computational analysis. ZOR- Mathematical Methods of Operations Research, 39:35-68, 1994.
14. P. Ning, Y. Cui, D. S. Reeves, Analyzing Intensive Intrusion Alerts Via Correlation, in Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID 2002), LNCS 2516, pages 74-94, October 2002.
15. R. Rosenfeld, A Maximum Entropy Approach to Adaptive Statistical Language Modeling, Computer, Speech, and Language, 10, 1996.
16. C. Siaterlis, and B. Maglaris, Towards multisensor data fusion for DoS detection, Proceedings of the 2004 ACM symposium on Applied computing, 2004.
17. G. Shafer. A Mathematical Theory of Evidence. Princeton University Press, Princeton, 1976.
18. H. Svensson and A. Jøsang, Correlation of Intrusion Alarms with Subjective Logic. In the proceedings of the sixth Nordic Workshop on Secure IT systems, Copenhagen, Denmark, 1-2 November, 2001.
19. H. Wu, M. Siegel, R. Stiefelhagen, and J. Yang. Sensor fusion using Dempster-Shafer theory. In Proceedings of IEEE Instrumentation and Measurement Technology Conference, Anchorage, AK, USA, 2002.
20. D. Yu, D. Frincke, A Novel Framework for Alert Correlation and Understanding, Springer's LNCS series, vol 3089. International Conference on Applied Cryptography and Network Security (ACNS) 2004.
21. S. A. Yemini, S. Kliger, E. Mozes, Y. Yemini and D. Ohsie, High speed and robust event correlation, IEEE Communications Magazine, May, 1996.