The Snort network intrusion detection system is well known for triggering large numbers of false alerts. In addition, it usually only warns of a potential attack without stating what kind of attack it might be. This paper presents a clustering approach for handling Snort alerts more effectively. Central to this approach is the representation of alerts using the Intrusion Detection Message Exchange Format, which is written in XML. All the alerts for each network session are assembled into a single XML document, thereby representing a pattern of alerts. A novel XML distance measure is proposed to obtain the distance between two such XML documents. A classical clustering algorithm, implemented based on this distance measure, is then applied to group the alert patterns into clusters. Our experiment with the MIT 1998 DARPA data sets demonstrates that the clustering algorithm can distinguish between normal sessions that give rise to false alerts and those sessions that contain real attacks, and in about half of the latter cases can effectively identify the name of the attack.

No abstract

No abstract

Refactoring is the process of transforming the internal structure of existing code while keeping the integrity of the code's functional requirements. Refactoring is proven to increase program maintainability, flexibility, and understandability and is recognized as a best practice in the software development community. However, with the exception of courses or lectures on extreme programming, refactoring is overlooked in the computer science curriculum. This paper presents the fourth lesson of an innovative pedagogical approach to teaching refactoring on the college level. This lesson covers the creation of well formed object-oriented methods including characteristics for evaluating such methods. Through this hands-on approach, building well formed object-oriented methods through refactoring can be better understood and integrated into the computer science curriculum.

Application development of a large number of graphical user interface (GUI) screens and reports requires a labor‐intensive process. In the typical scenario, a GUI developer drags each component, such as the textfield, label, and error messages, on each of the new GUI screens or reports. They then set the component properties and perhaps write any validation routines for input data. Using the proposed Observation Panel Bean (OPB), the developer drags only one component per field, and the OPB dynamically builds the GUI components with consistent properties and links the observation field to the needed validation routine. With little development effort these fields are simply selected from the data dictionary and placed on the GUI. The proposed OPB uses Fowler's observation pattern as a high‐level abstraction representing attributes observed about information in the application domain. The panel collaborates with the observation pattern to set the label, error message, and properties of the various components. Yoder's validator pattern collaborates with the observation pattern and the data dictionary to validate the observations. The proposed OPB decreases GUI development time, adds adaptability to GUI design, and increases consistency in GUI component presentation. Copyright © 2002 John Wiley & Sons, Ltd.