DocumentCode :
1666162
Title :
A correlative context-based framework for network intrusion detection system
Author :
Wang, Ye ; Abdel-Wahab, Hussein
Author_Institution :
Dept. of Comput. Sci., Old Dominion Univ., Norfolk, VA, USA
fYear :
2005
Firstpage :
463
Lastpage :
468
Abstract :
Intrusion detection system (IDS) is one of the most important security protection mechanisms. Although many IDS commercial products and research projects exist, we still face a serious problem under current systems, a high false positive rate. We observe that current network IDSs don´t make full use of the information available from different levels and points of the protected network, and we argue that the utilization of this information is essential. We introduce a new framework for network IDSs based on a network context awareness (NCA) layer as an additional data source to IDSs. We describe the architecture of NCA and methods of how to extract network information into NCA. A correlation engine is presented that works on alerts generated by a specific IDS system (Snort) and NCA information. Our experimental results using simulated attacks show that our proposed solution significantly reduces the false alarm rate and has the potential to greatly improve the efficacy of detecting novel attacks.
Keywords :
computer networks; security of data; telecommunication security; IDS commercial products; correlative context-based framework; network context awareness; network information extraction; network intrusion detection system; security protection mechanisms; Computational modeling; Computer science; Computer security; Context awareness; Data mining; Face detection; Humans; Intrusion detection; Protection; Statistics;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Computers and Communications, 2005. ISCC 2005. Proceedings. 10th IEEE Symposium on
ISSN :
1530-1346
Print_ISBN :
0-7695-2373-0
Type :
conf
DOI :
10.1109/ISCC.2005.6
Filename :
1493767
Link To Document :
بازگشت