Log correlation for intrusion detection: A proof of concept

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2003-January, Issue , 2003, Pages 255-264

  Abad, Cristina ^a,b   Taylor, Jed ^a   Sengul, Cigdem ^a   Yurcik, William ^b   Zhou, Yuanyuan ^a   Rowe, Ken ^c  

^a University of Illinois at Urbana Champaign   (United States)

^b UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

^c SCIENCE APPLICATIONS INTERNATIONAL CORPORATION   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; DATA MINING; MERCURY (METAL); SECURITY OF DATA; SECURITY SYSTEMS;

ANOMALY DETECTION; COMMERCIAL PRODUCTS; DATA-MINING TOOLS; DIFFERENT ATTACKS; IMPROVED TECHNIQUES; INTRUSION DETECTION SYSTEMS; NETWORKED SYSTEMS; PROOF OF CONCEPT;

INTRUSION DETECTION;

EID: 84944721192     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSAC.2003.1254330     Document Type: Conference Paper

References (27)

1. D. Barbara, J. Couto, S. Jajodia, L. Popyack, and N. Wu. ADAM: Detecting intrusions by data mining. In Proc. of the IEEE Workshop on Information Assurance and Security, Jun. 2001.
2. J. B. D. Cabrera, L. Lewis, and R. K. Mehra. Detection and classification of intrusions and faults using sequences of system calls. ACM SIGMOD Record, 30(4):25-34, Dec. 2001.
3. W. Cohen. Fast effective rule induction. In 12th Intl. Conference on Machine Learning (ICML'95), 1995.
4. F. Cuppens, F. Autrel, A. Mìege, and S. Benferhat. Correlation in an intrusion detection process. In SÉcurité des Communications sur Internet (SECI'02), Sep. 2002.
5. H. Debar and A. Wespi. Aggregation and correlation of intrusion-detection alerts. In Proc. of the 4th Intl. Symposium on Recent Advances in Intrusion Detection (RAID'2001), Oct. 2001.
6. D. E. Denning. An intrusion-detection model. IEEE Trans. on Software Engineering, 13(2):222-232, Feb. 1987. Special Issue on Service Overlay Networks.
7. D. Dittrich. The DoS project's "trinoo" distributed denial of service attack tool, Oct. 1999. . (Mar. 15, 2003).
8. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for Unix processes. In Proc. of the IEEE Symposium on Research in Security and Privacy, pages 120-128, 1996.
9. IBM Tivoli intrusion manager, Jun. 2003. . (Sep. 1, 2003).
10. Y. Kaplan. Api spying techniques for windows 9x, nt, and 2000, Apr. 2000. . (Feb. 12, 2003).
11. K. Kendall. A database of computer attacks for the evaluation of intrusion detection systems. Master's thesis, MIT, 1998.
12. G. H. Kim and E. H. Spafford. Experiences with tripwire: Using integrity checkers for intrusion detection. In Proc. of the 3rd Annual System Administration, Networking and Security Conference (SANS III), pages 89-101, Apr. 1994.
13. C. Kodology, R. Day, C. A. Christiansen, and J. Daly. Data and network integrity - technology to invoke trust in it - the tripwire solution, 2001. An IDCWhite Paper.
14. W. Lee and S. Stolfo. Data mining approaches for intrusion detection. In Proc. of the 7th USENIX Security Symposium (SECURITY'98), Jan. 1998.
15. W. Lee, S. Stolfo, and K. Mok. A data mining framework for building intrusion detection models. In Proc. of the IEEE Symposium on Security and Privacy, May 1999.
16. Netforensics: Security information management, 2003. . (Jun. 1, 2003).
17. neuSECURE: Centralized security operations and threat management software, Aug. 2003. . (Jun. 1, 2003).
18. P. Ning, Y. Cui, and D. S. Reeves. Constructing attack scenarios through correlation of intrusion alerts. In Proc. of the 9th ACM Conference on Computer & Communications Security, pages 245-254, Nov. 2002.
19. S. Patton, W. Yurcik, and D. Doss. An achilles' heel in signature-based ids: Squealing false positives in SNORT. In Proc. of the 4th Intl. Symposium on Recent Advances in Intrusion Detection (RAID'2001), Oct. 2001.
20. P. A. Porras, M. W. Fong, and A. Valdes. A mission impact-based approach to infosec alarm correlation. In Proc. of the 5th Intl. Symposium on Recent Advances in Intrusion Detection (RAID'2002), pages 95-114, Oct. 2002.
21. T. H. Ptacek and T. N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection. Technical report, Secure Networks, Inc., 1998.
22. L. Rohde. Yaha virus lingers into the new year, Jan. 2003. IDG News Service.
23. Sans portal, May 2003. . (Jun. 5, 2003).
24. C. Silvestro. Intrusion detection systems and log correlation. Master's thesis, Cefriel: Consorzio per la Formazione e la Ricerca in Ingegneria dell'Informazione, Jun. 2002.
25. Snort: The open source network intrusion detection system, Sep. 2003. . (Sep. 2, 2003).
26. L. Spitzner, editor. Know Your Enemy: Revealing the Security Tools, Tactics, and Motives of the Blackhat Community, chapter 6. Addison-Wesley, Aug. 2001.
27. J. Walker. Security event correlation: Where are we now, 2001. net IQ whitepaper. . (Aug. 20, 2003).