A New Model to Manage IDS Alerts
نویسندگان
چکیده
The goal of this paper is to present a new model to reduce the alerts generated by an IDS (Bace, 2000) analyzer. This model allows the administrator to analyze only the messages that really generate risks for an environment or machine. This is very important when you have a complex environment with a lot of machines with many services in them.
منابع مشابه
Real-Time intrusion detection alert correlation and attack scenario extraction based on the prerequisite consequence approach
Alert correlation systems attempt to discover the relations among alerts produced by one or more intrusion detection systems to determine the attack scenarios and their main motivations. In this paper a new IDS alert correlation method is proposed that can be used to detect attack scenarios in real-time. The proposed method is based on a causal approach due to the strength of causal methods in ...
متن کاملAlert Correlation in a Cooperative Intrusion Detection Framework
This paper presents the work we have done within the MIRADOR project to design CRIM, a cooperative module for intrusion detection systems (IDS). This module implements functions to manage, cluster, merge and correlate alerts. The clustering and merging functions recognize alerts that correspond to the same occurrence of an attack and create a new alert that merge data contained in these various...
متن کاملAlert correlation and prediction using data mining and HMM
Intrusion Detection Systems (IDSs) are security tools widely used in computer networks. While they seem to be promising technologies, they pose some serious drawbacks: When utilized in large and high traffic networks, IDSs generate high volumes of low-level alerts which are hardly manageable. Accordingly, there emerged a recent track of security research, focused on alert correlation, which ext...
متن کاملUsing Correlation Detection for IMA-IDS Architecture
This paper presents a new syntactic and semantic representation for network events. Our goal is to offer to IMA-IDS (Intelligent and Mobile Agent Intrusion Detection System), an efficient correlation engine. IMAIDS is a global architecture for using intelligent and mobile agent for intrusion detection system. As described widely in [1] this architecture aims at taking advantages of agent mobili...
متن کاملIntrusion Detection System - False Positive Alert Reduction Technique
Intrusion Detection System (IDS) is the most powerful system that can handle the intrusions of the computer environments by triggering alerts to make the analysts take actions to stop this intrusion, but the IDS is triggering alerts for any suspicious activity which means thousand alerts that the analysts should take care of it. IDS generate a large number of alerts and most of them are false p...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2004