.png){kind=icon}
返回
Enhancing IDS performance through comprehensive alert post-processing
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2013.03.005.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Intrusion detection systems (IDS) are among the most common countermeasures against network attacks. In order to improve the alerts obtained from them, various methods of post-processing have been proposed. These methods usually try to alleviate specific drawbacks of intrusion detection. We propose a system that is a post-processing solution. The input of our system is a set of multiple IDS sensors alert sets. Each set's alerts are aggregated in order to improve their quality, before multiple alert sets merge into one general alert set. Then, a low clustering procedure allows the system to hypothesize about missed security events and to create relevant alerts. The main clustering phase comes next, before the final step, in which a clusters graph is generated to produce a high level presentation of the security events. The system has been tested using the DARPA 2000 dataset, as well as a live network dataset, and has produced satisfactory results. (c) 2013 Elsevier Ltd. All rights reserved.
Keyword:
Intrusion detection systems
Aggregation
Correlation
Prediction
Visualization
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
分享收藏What is the risk from wild animals in food-borne pathogen contamination of plants?.png)
CABI Reviews
CABI ReviewsIF0
PREAI
分享收藏
查看更多内容