Alerts analysis and visualization in network-based intrusion detection systems

Proceedings - SocialCom 2010: 2nd IEEE International Conference on Social Computing, PASSAT 2010: 2nd IEEE International Conference on Privacy, Security, Risk and Trust

Volumn , Issue , 2010, Pages 785-790

  Yang, Li ^a   Gasior, Wade ^a   Katipally, Rajeshwar ^a   Cui, Xiaohui ^b  

^a Graduate School of Computational Engineering   (United States)

^b OAK RIDGE NATIONAL LABORATORY   (United States)

Author keywords

Clustering; Flocking; Intrusion detection; Visulization

Indexed keywords

ALERT DATA; CLUSTERING; CLUSTERING PROCESS; END USERS; FLOCKING; MULTI-STAGE ATTACK; NETWORK ADMINISTRATOR; NETWORK BASED INTRUSION DETECTION SYSTEMS; NETWORK TOPOLOGY; SHORT TIME FRAMES; THIRD COMPONENT; VISUAL MAPPING; VISULIZATION;

CLUSTER ANALYSIS; CLUSTERING ALGORITHMS; COMPUTER CRIME; DATA VISUALIZATION; ELECTRIC NETWORK TOPOLOGY; VISUALIZATION;

INTRUSION DETECTION;

EID: 78649257208     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SocialCom.2010.120     Document Type: Conference Paper

References (20)

1. Hideki Koike, Kazuhiro Ohno, SnortView: Visualization System of Snort Logs, Proceedings of the ACM workshop on Visualization and data mining for computer security, Washington DC, USA, 2004.
2. Soleimani M., Khosrowshahi E., Doroud M., Damanafshan M., Behzadi A., Abbaspour M., A Reliable Analyzer and Archiver for Snort Intrusion Detection System, Proceedings of the 2007 ACM symposium on Applied computing, Korea, 2007.
3. Patrick Hertzog, Visualizations to improve reactivity towards security incidents inside corporate networks, Proceedings of the 3rd international workshop on Visualization for computer security, Alexandria, Virginia, USA, 2006.
4. Shabtai, Klimov, Shahar, Elovici, An intelligent, interactive tool for exploration and visualization of time-oriented security data, Proceedings of the 3rd international workshop on Visualization for computer security, Alexandria, Virginia, USA, 2006
5. Mansmann, Fisher, Keim, North, Visual support for analyzing network traffic and intrusion detection events using TreeMap and graph representations, Proceedings of the Symposium on Computer Human Interaction for the Management of Information Technology, Maryland, USA, 2009.
6. Mathew, Giomundo, Uoadhyaya, Sudit,Slotz, Understanding multistage attacks by attack-track based visualization of heterogeneous event streams, Proceedings of the 3rd international workshop on Visualization for computer security, Virginia, USA, 2006.
7. Abdullah, Copeland, Tool update: high alarm count issues in IDS rainstorm, Proceedings of the 3rd international workshop on Visualization for computer security, Alexandria, Virginia, USA, 2006.
8. Wenke Lee, Applying data mining to intrusion detection: the quest for automation, efficiency, and credibility, ACM SIGKDD Explorations Newsletter, December, 2002.
9. Dokas, Kumar, Lazarevic, Srivastava, Tan, Data Mining for Network Intrusion Detection, USA, 2004.
10. Anup K.Ghosh, Aaron Schwartzbard and Michael Schatz. Learning Program Behavior Profiles for Intrusion Detection. Proceedings of the 1st conference on Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, pp.51-62, 2002.
11. Pang-Ning Tan, Michael Stenbach, Vipin Kumar. Introduction to data mining. Pearson Addison Wesley. 2006.
12. The snort. http://www.snort.org.
13. Jiawei Han and Micheline Kamber, Data mining concepts and techniques. Academic Press, San Diego, California, 2001.
14. Dokas, Kumar, Lazarevic, Srivastava, Tan, Data Mining for Network Intrusion Detection, USA, 2004.
15. Klaus Juslich.Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security, vol. 6, pp. 443-471, 2002.
16. John R. Goodall and A. Ant Ozok and Wayne G. Lutters and Penny Rheingans and Anita Komlodi. A user - centered approach to visualizing network traffic for intrusion detection. Extended Abstracts on Human Factors in Computing Systems, pp. 1403 -1406, Portland, OR, USA, April, 2005.
17. Lane, T. and Brodley, C. E., Temporal sequence learning and data reduction for anamoly detection.Proceedings of ACM Transactions on Information and System Security, pp. 295-331, 1999.
18. Luis Gravano and Panagiotis G. Ipeirotis and H. V. Jagadish and Nick Koudas and S. Muthukrishnan and Lauri Pietarinen and Divesh Srivastava. Using q-grams in a DBMS for approximate string processing. IEEE Data Engineering Bulletin. pp.28-34, vol. 24, 2001.
19. Goodall, John R., Wayne G. Lutters, Penny Rheingans, and Anita Komlodi. "Preserving the Big Picture: Visual Network Traffic Analysis with TNV." Proceedings of the Workshop on Visualization for Computer Security (VizSec), IEEE Press, 2005, 47-54.
20. Y. Livnat et al., "A Visualization Paradigm for Network Intrusion Detection," Proc. IEEE Workshop Information Assurance and Security (IAW), IEEE Press, 2005, pp. 92-99.