The Design and Testing of Automated Signature Generation Engine for Worms Detection
KES-AMSTA '07 Proceedings of the 1st KES International Symposium on Agent and Multi-Agent Systems: Technologies and Applications
Implementing IDS Management on Lock-Keeper
ISPEC '09 Proceedings of the 5th International Conference on Information Security Practice and Experience
Intrusion detection and identification system using data mining and forensic techniques
IWSEC'07 Proceedings of the Security 2nd international conference on Advances in information and computer security
FuzMet: a fuzzy-logic based alert prioritization engine for intrusion detection systems
International Journal of Network Management
Survey A model-based survey of alert correlation techniques
Computer Networks: The International Journal of Computer and Telecommunications Networking
| Hi-index | 0.00 |
In response to the daunting threats of cyber attacks, a promising approach is computer and network forensics. Intrusion Detection System is an indispensable part of computer and network forensics. It is deployed to monitor network and host activities including data flows and information accesses etc. But current intrusion detection products presents many flaws including alert flooding, too many false alerts and isolated alerts etc. This paper describes an ongoing project to develop an intrusion alert management system - TRINETR. We present a collaborative architecture design for multiple intrusion detection systems to work together to detect real-time network intrusions. The architecture is composed of three parts: Alert Aggregation, Knowledge-based Alert Evaluation and Alert Correlation. The architecture is aimed at reducing the alert overload by aggregating alerts from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information into alert evaluation process and correlating events based on logical relations to generate global and synthesized alert report. The first two parts of the architecture have been implemented and the implementation results are presented in this paper.