Managing alerts in a multi-intrusion detection environment 论文

2005引用 251

Network Security and Intrusion DetectionAnomaly Detection Techniques and ApplicationsTime Series Analysis and Forecasting

网络安全 Anomaly Detection Techniques and Applications Time Series Analysis and Forecasting Network Security and Intrusion Detection

关系图谱

作者

摘要

There are several approaches for intrusion detectionbut none of them is fully satisfactory. They generallygenerate too many false positives and the alerts are tooelementary and not enough accurate to be directlymanaged by a security administrator. A promisingapproach is to develop a cooperation module to analyzealerts and to generate more global and synthetic alerts.This paper presents the work we did in this context withinthe MIRADOR project. We suggest specifications for threefunctions: alert base management, alert clustering andalert merging. The approach is compliant with theIDMEF format currently being defined at the IETF.

作者查看全部 (1)

Frédéric Cuppens

Managing alerts in a multi-intrusion detection environment 论文

详细信息

摘要

作者查看全部 (1)

相关技术查看全部 (2)

相关事件

相关文章