POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System

Authors:
Damiano Bolzoni;Sandro Etalle;Pieter Hartel;Emmanuele Zambon
Affiliations:
University of Twente, Netherlands;University of Twente, Netherlands;University of Twente, Netherlands;Universita Ca Foscari di Venezia, Italy
Venue:
IWIA '06 Proceedings of the Fourth IEEE International Workshop on Information Assurance
Year:
2006

Citing 0
Cited 10

Building intrusion pattern miner for Snort network intrusion detection system

Journal of Systems and Software
ATLANTIDES: an architecture for alert verification in network intrusion detection systems

LISA'07 Proceedings of the 21st conference on Large Installation System Administration Conference
Boosting Web Intrusion Detection Systems by Inferring Positive Signatures

OTM '08 Proceedings of the OTM 2008 Confederated International Conferences, CoopIS, DOA, GADA, IS, and ODBASE 2008. Part II on On the Move to Meaningful Internet Systems
Graph neuron and hierarchical graph neuron, novel approaches toward real time pattern recognition in wireless sensor networks

Proceedings of the 2009 International Conference on Wireless Communications and Mobile Computing: Connecting the World Wirelessly
Panacea: Automating Attack Classification for Anomaly-Based Network Intrusion Detection Systems

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Modeling protocol based packet header anomaly detector for network and host intrusion detection systems

CANS'07 Proceedings of the 6th international conference on Cryptology and network security
Cyber-critical infrastructure protection using real-time payload-based anomaly detection

CRITIS'09 Proceedings of the 4th international conference on Critical information infrastructures security
Classification of packet contents for malware detection

Journal in Computer Virology
N-Gram against the machine: on the feasibility of the n-gram network analysis for binary protocols

RAID'12 Proceedings of the 15th international conference on Research in Attacks, Intrusions, and Defenses
Review Article: RePIDS: A multi tier Real-time Payload-based Intrusion Detection System

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present POSEIDON, a new anomaly-based network intrusion detection system. POSEIDON is payload-based, and has a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system. Our benchmarks on the 1999 DARPA data set show a higher detection rate and lower number of false positives than PAYL and PHAD.