Collaborative intrusion detection system (CIDS): A framework for accurate and efficient IDS

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2003-January, Issue , 2003, Pages 234-244

  Wu, Yu Sung ^a   Foo, Bingrui ^a   Mei, Yongguo ^a   Bagchi, Saurabh ^a  

^a Purdue University   (United States)

Author keywords

Bayesian network based detection; Event correlation; False alarms; Intrusion detection; Missed alarms

Indexed keywords

ALARM SYSTEMS; BAYESIAN NETWORKS; BUFFER STORAGE; COMPUTER CRIME; ERRORS; GRAPHIC METHODS; MANAGERS; MERCURY (METAL); NETWORK LAYERS; SECURITY OF DATA; SECURITY SYSTEMS;

BUFFER OVERFLOW ATTACKS; COLLABORATIVE INTRUSION DETECTION SYSTEM; DESIGN AND IMPLEMENTATIONS; DISTRIBUTED SYSTEMS; EVENT CORRELATION; FALSE ALARMS; MISSED ALARMS; PERFORMANCE DEGRADATION;

INTRUSION DETECTION;

EID: 84944738739     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSAC.2003.1254328     Document Type: Conference Paper

References (19)

1. Curtis A. Carver, John M.D. Hill, and Udo W. Pooch, "Limiting Uncertainty in Intrusion Response," Proceedings of the 2001 IEEE Workshop on Information Assurance and Security United States Military Academy, West Point, NY, 5-6 June, 2001.
2. "Apache Chunk Buffer Overflow Attack". At: http://httpd.apache.org/info/security-bulletin-20020617.txt
3. F. Cuppens and R. Ortalo, "LAMBDA: A Language to Model a Database for Detection of Attacks", In Proceedings of the Third International Workshop on the Recent Advances in Intrusion Detection (RAID'2000), Toulouse, France, October 2000.
4. F. Cuppens and A. Miege, "Alert Correlation in a Cooperative Intrusion Detection Framework", In IEEE Symposium on Security and Privacy, Oakland, USA, 2002.
5. M. Dacier and Y. Deswarte, "The Privilege Graph: an Extension to the Typed Access Matrix Model", in European Symposium in Computer Security (ESORICS'94), (D. Gollman, Ed.), Lecture Notes in Computer Science, 875, pp.319-334, Springer-Verlag, Brighton, UK, November 1994.
6. M. Dacier, Y. Deswarte and M. Kaâniche, "Models and Tools for Quantitative Assessment of Operational Security", in 12th International Information Security Conference (IFIP/SEC'96), (S.K. Katsikas and D. Gritzalis, Eds.), pp.177-186, Chapman & Hall, Samos (Greece), May 1996.
7. O. Dain and R. Cunningham, "Fusing a Heterogeneous Alert Stream into Scenarios", In Proc. of the 2001 ACM Workshop on Data Mining for Security Applications, pages 1-13, Nov. 2001.
8. T. Verwoerd and R. Hunt, "Intrusion Detection Techniques and Approaches", In Computer Communications vol. 25, Issue 15, 2002.
9. "Avaya Labs Research - Projects: Libsafe", At http://www.research.avayalabs.com/project/libsafe
10. "Source Forge.net: Project Info - The libpcap project", At: http://sourceforge.net/projects/libpcap
11. Kevin Murphy, "Bayes Net Toolbox for Matlab", At: http://www.ai.mit.edu/~murphyk/Software/BNT/bnt.html
12. Kevin Murphy, "Tutorial on Bayesian Network Toolbox", At: http://www.ai.mit.edu/~murphyk/Software/BNT/BNT-mathworks.ppt
13. Peng Ning, Yun Cui, Douglas S. Reeves, "Constructing Attack Scenarios through Correlation of Intrusion Alerts", In Proceedings of the 9th ACM Conference on Computer & Communications Security (CCS 2002), pages 245-254, Washington D.C., November 2002.
14. Rodolphe Ortalo and Yves Deswarte and Mohamed Kaaniche, "Experimenting with Quantitative Evaluation Tools for Monitoring Operational Security", Journal of Software Engineering, vol. 25, no. 5, pp. 633-650, 1999.
15. M. Roesch, "Snort - Lightweight Intrusion Detection for Networks", In Proceedings of USENIX LISA'99, November 1999.
16. "Apache Open SSL Attack". At: http://www.cert.org/advisories/CA-2002-27.html
17. S. Staniford, J.A. Hoagland and J.M. McAlerney, "Practical Automated Detection of Stealthy Portscans", In the Journal of Computer Security, Volume 10, Issues 1/2, 2002, pp. 105-136.
18. S. Templeton and K. Levit, "A requires/provides model for computer attacks", In Proc. of New Security Paradigms Workshop, pages 31-38, September 2000.
19. A. Valdes and K. Skinner, "Probabilistic alert correlation", In Proc. of the 4th Int'l Symposium on Recent Advances in Intrusion Detection (RAID 2001), pages 54-68, 2001.