Adapting query optimization techniques for efficient alert correlation

IFIP Advances in Information and Communication Technology

Volumn 142, Issue , 2004, Pages 75-88

  Ning, Peng ^a   Xu, Dingbang ^a  

^a North Carolina State University   (United States)

Author keywords

Intrusion alert correlation; Intrusion detection; Query optimization

Indexed keywords

CONTAINERS; EFFICIENCY; EXPERIMENTS; FORESTRY; INTRUSION DETECTION;

ALERT CORRELATION; ATTACK SCENARIOS; INSERTION OPERATIONS; INTERACTIVE ANALYSIS; INTRUSION ALERT CORRELATION; INTRUSION ALERTS; INTRUSION DETECTION SYSTEMS; QUERY OPTIMIZATION;

TREES (MATHEMATICS);

EID: 84902482261     PISSN: 18684238     EISSN: None     Source Type: Book Series    
DOI: None     Document Type: Conference Paper

References (15)

1. A. Aho, J. Hopcroft, and J.D. Ullman. The Design and Analysis of Computer Algorithms. Addison-Wesley, 1974.
2. A. Ammann, M. Hanrahan, and R. Krishnamurthy. Design of a memory resident DBMS. In Proc. of IEEE COMPCON, February 1985.
3. D. Comer. The ubiquitous B-Tree. ACM Computeing Surveys, 11(2): 121-137, 1979.
4. T. H. Cormen, C. E. Leiserson, and R. L. Rivest. Introduction to Algorithms. The MIT Press, 1989.
5. F. Cuppens and A. Miege. Alert correlation in a cooperative intrusion detection framework. In Proc. of the 2002 IEEE Symposium on Security and Privacy, May 2002.
6. O. Dain and R.K. Cunningham. Fusing a heterogeneous alert stream into scenarios. In Proc. of the ACM Workshop on Data Mining for Security Applications, November 2001.
7. H. Garcia-Molina, J. Widom, J.D. Ullman. Database System Implementation. Prentice Hall, 2000.
8. D. Knuth. The Art of Computer Programming. Addison-Wesley, 1973.
9. T. J. Lehman and M. J. Carey. A study of index structure for main memory database management systems. In Proc. of the 12th Int'l Conf. on Very Large Databases, pages 294-303, August 1986.
10. W. Litwin. Linear hashing: A new tool for file and table addressing. In Proc. of the 6th Conf. on Very Large Data Bases, pages 212-223, Montreal, Canada, October 1980.
11. P. Ning, Y. Cui, and D. S Reeves. Constructing attack scenarios through correlation of intrusion alerts. In Proc. of the 9th ACM Conf. on Computer and Communications Security, pages 245-254, November 2002.
12. P. Ning and D. Xu. Adapting query optimization techniques for efficient intrusion alert correlation. Technical Report TR-2002-13, NCSU Computer Science, August 2002.
13. S. Stamford, J.A. Hoagland, and J.M. McAlerney. Practical automated detection of stealthy portscans. Journal of Computer Security, 10(1/2):105-136, 2002.
14. S. Templeton and K. Levitt. A requires/provides model for computer attacks. In Proc. of New Security Paradigms Workshop, pages 31-38, September 2000.
15. A. Valdes and K. Skinner. Probabilistic alert correlation. In Proc. of the 4th International Symposium on Recent Advances in Intrusion Detection (RAID 2001), pages 54-68, 2001.