Decentralized event correlation for intrusion detection

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2288, Issue , 2002, Pages 114-131

  Krügel, Christopher ^a   Toth, Thomas ^a   Kerer, Clemens ^a  

^a VIENNA UNIVERSITY OF TECHNOLOGY   (Austria)

Author keywords

Event Correlation; Intrusion Detection; Network Security

Indexed keywords

CHROMIUM COMPOUNDS; COMPUTER CRIME; CRYPTOGRAPHY; INTRUSION DETECTION; SPECIFICATION LANGUAGES;

BUILDING BLOCKES; DECENTRALIZED APPROACH; DISTRIBUTED PATTERNS; EVENT CORRELATION; INTRUSION DETECTION SYSTEMS; MULTIPLE POINTS; PROTECTED NETWORKS; PROTOTYPE IMPLEMENTATIONS;

NETWORK SECURITY;

EID: 84949978826     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/3-540-45861-1_10     Document Type: Conference Paper

References (16)

1. Jai Sundar Balasubramaniyan, Jose Omar Garcia-Fernandez, David Isacoff, Eugene Spafford, and Diego Zamboni. An Architecture for Intrusion Detection using Autonomous Agents. In 14th IEEE Computer Security Applications Conference, December 1998.
2. Marc Crosbie and Eugene Spafford. Defending a computer system using autonomous agents. In Proceedings of the 18th National Information Systems Security Conference, October 1995.
3. Jose Duarte de Queiroz, Luiz Fernando Rust da Costa Carmo, and Luci Pirmez. Micael: An autonomous mobile agent system to protect new generation networked applications. In 2nd Annual Workshop on Recent Advances in Intrusion Detection, September 1999.
4. IETF Intrusion Detection Working Group. Intrusion Detection Message Exchange Format. http://www.ietf.org/html.charters/idwg-charter.html.
5. Judith Hochberg, Kathleen Jackson, Cathy Stallins, J. F. McClary, David DuBois, and Josephine Ford. NADIR: An automated system for detecting network intrusion and misuse. Computer and Security, 12(3):235–248, May 1993.
6. Christopher Krügel and Thomas Toth. An efficient, IP based solution to the’Logical Timestamp Wrapping’ problem. In 6th International Conference on Telecommunications, 2001.
7. Christopher Krügel, Thomas Toth, and Engin Kirda. Service Specific Anomaly Detection for Intrusion Detection. In ACM Symposium on Applied Computing (to appear), 2002.
8. L. Lamport. Time, clocks and the ordering of events in a distributed system. Comms. ACM, 21(7):558–65, 1978.
9. Peter G. Neumann and Phillip A. Porras. Experience with EMERALD to date. In 1st USENIX Workshop on Intrusion Detection and Network Monitoring, pages 73–80, Santa Clara, California, USA, April 1999.
10. Phillip A. Porras and Peter G. Neumann. EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances. In Proceedings of the 20th NIS Security Conference, October 1997.
11. Martin Roesch. Snort - lightweight intrusion detection for networks. In USENIX Lisa 99, 1999.
12. S. R. Snapp, J. Brentano, G. V. Dias, T. L. Goan, L. T. Heberlein, C. Ho, K. N. Levitt, B. Mukherjee, S. E. Smaha, T. Grance, D. M. Teal, and D. Mansur. DIDS (Distributed Intrusion Detection System) - Motivation, Architecture and an early Prototype. In 14th National Security Conference, pages 167–176, October 1991.
13. S. Staniford-Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, and D. Zerkle. GrIDS - A Graph based Intrusion Detection System for large networks. In Proceedings of the 20th National Information Systems Security Conference, volume 1, pages 361–370, October 1996.
14. G. Vigna and R. Kemmerer. NetSTAT: A network-based intrusion detection system. In Proceedings of the 14th Annual Computer Security Applications Conference, December 1998.
15. Giovanni Vigna, Richard A. Kemmerer, and Per Blix. Designing a Web of highlyconfigurable Intrusion Detection Sensors. In Recent Advances in Intrusion Detection. Springer Lecture Notes in Computer Science, 2001.
16. Gregory B. White, Eric A. Fisch, and Udo W. Pooch. Cooperating Security Managers: A peer-based intrusion detection system. IEEE Network, pages 20–23, January/ February 1996.