Abstract
As the Internet technologies are innovated faster, the side-effects, such as hacking, virus, and worm, occur more and more. To control these side-effects, many companies, governments deploy and operate IDS on their networks. However, current IDS system has some problems to solve as follows, and these problems make the IDS more vulnerable to fine-grained, distributed, and large-scaled attacks. Therefore we propose a flexible and effective system using heterogeneous correlation and aggregation methods to control these problems. The system can generate a proper event or a new event for related attack. It helps that the administrator analyzes the excessive events effectively and responses against the attack properly.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Lee, W.: A Framework for Constructing Features and Models for Intrusion Detection System. PhD thesis, Columbia University (1999)
Perrochon, L., Jang, E., Luckham, D.C.: Enlisting Event Patterns for Cyber Battlefield Awareness. In: DARPA Information Survivability Conference & Exposition (DISCEX 2000), Hilton Head, South Carolina, USA (2000)
Debar, H., Wespi, A.: Aggregation and Correlation of Intrusion-Detection Alerts. In: Proceedings of 2001 International Workshop on Recent Advances in Intrusion Detection, Davis, CA, USA (2001)
Valdes, A., Skinne, K.: Probabilistic Alert Correlation. In: Fourth International Workshop on the Recent Advances in Intrusion Detection, Davis, CA, USA (2001)
Phillip, A.: Porras, et al.: A Mission impact-Based Approach to INFOSEC Alarm Correlation. In: International Workshop on the Recent Advances in Intrusion Detection, Zurich, Switzerland (2002)
Cuppens, F.: Managing alerts in a multi intrusion detection environment. In: 17th Annual Computer Security Applications Conference (ACSAC), New Orleans, USA (2001)
Porras, P., Neumann, P.: Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances. In: National Security Conference (1997)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2004 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Lee, DH., Seo, JT., Ryou, JC. (2004). Alerts Correlation System to Enhance the Performance of the Network-Based Intrusion Detection System. In: Jin, H., Pan, Y., Xiao, N., Sun, J. (eds) Grid and Cooperative Computing - GCC 2004. GCC 2004. Lecture Notes in Computer Science, vol 3251. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-30208-7_48
Download citation
DOI: https://doi.org/10.1007/978-3-540-30208-7_48
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-23564-4
Online ISBN: 978-3-540-30208-7
eBook Packages: Springer Book Archive