A case-based approach to network intrusion detection

Schwartz, Daniel G.; Stoecklin, Sara; Yilmaz, Erbil

doi:10.1109/icif.2002.1020933

Cited by 13 publications

(5 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Efforts to deal with this issue have nonetheless been explored using artificial intelligence techniques. In particular, Chavan et al 3 use neural networks and a fuzzy inference system, and Schwartz et al 22 briefly discuss the possibility of improving the efficacy of Snort through shifting from a rule-based to a case-based reasoning system. The present paper is an outgrowth from the latter work.…”

Section: Related Workmentioning

confidence: 99%

Distinguishing false from true alerts in Snort by data mining patterns of alerts

Long¹,

Schwartz²,

Stoecklin³

2006

SPIE Proceedings

View full text Add to dashboard Cite

The Snort network intrusion detection system is well known for triggering large numbers of false alerts. In addition, it usually only warns of a potential attack without stating what kind of attack it might be. This paper presents a clustering approach for handling Snort alerts more effectively. Central to this approach is the representation of alerts using the Intrusion Detection Message Exchange Format, which is written in XML. All the alerts for each network session are assembled into a single XML document, thereby representing a pattern of alerts. A novel XML distance measure is proposed to obtain the distance between two such XML documents. A classical clustering algorithm, implemented based on this distance measure, is then applied to group the alert patterns into clusters. Our experiment with the MIT 1998 DARPA data sets demonstrates that the clustering algorithm can distinguish between normal sessions that give rise to false alerts and those sessions that contain real attacks, and in about half of the latter cases can effectively identify the name of the attack.

show abstract

Section: Related Workmentioning

confidence: 99%

Distinguishing false from true alerts in Snort by data mining patterns of alerts

Long¹,

Schwartz²,

Stoecklin³

2006

SPIE Proceedings

View full text Add to dashboard Cite

show abstract

“…In the defense in-depth strategy, firewalls and intrusion detection systems (IDSs) are considered as the first and the second lines of defense respectively [18]. A proof of concept implementation of an SMS-bot, which has the same role as a firewall, is presented in [19].…”

Section: B From the Kill Zone To The Third Line Of Defensementioning

confidence: 99%

Third line of defense strategy to fight against SMS-based malware in android smartphones

Derhab

Saleem

Youssef

2014

2014 International Wireless Communications and Mobile Computing Conference (IWCMC)

View full text Add to dashboard Cite

In this paper, we inspire from two analogies: the warfare kill zone and the airport check-in system, to design and deploy a new line in the defense-in-depth strategy, called the third line. This line is represented by a security framework, named the Intrusion Ambushing System and is designed to tackle the issue of SMS-based malware in the Android-based Smartphones. The framework exploits the security features offered by Android operating system to prevent the malicious SMS from going out of the phone and detect the corresponding SMS-based malware. We show that the proposed framework can ensure full security against SMS-based malware. In addition, an analytical study demonstrates that the framework offers optimal performance in terms of detection time and execution cost in comparison to intrusion detection systems based on static and dynamic analysis.

show abstract

“…Based on IDS [3] and active network [4] ideas, it has MAC address, IP address and Port types besides traditional Byte, Word and Integer types. Programmers can define the IP variables and compare or assign its value, don't care it is Big-endian or Little-endian.…”

Section: Network Oriented Featuresmentioning

confidence: 99%

NSL: a network-security-oriented language

2005

Network Architectures, Management, and Applications II

View full text Add to dashboard Cite

The wide use of network improves security risks, but the traditional network security tools are single-functional and they are difficult to extend and manage. These security tools can't fulfill the need of users. The paper presents a network security oriented language: NSL (Network Security Language). The language provides a common abstract layer of all kinds of security application. It can be used to construct multifunctional, distributed and extendable security applications, satisfying various and emergent security requirements. The paper describes its network oriented structures, features and three security mechanisms. The NSL interpreter implementation is also analyzed by the performance test. At last, the paper puts forward improving work which will be done in the future.

show abstract

A case-based approach to network intrusion detection

Cited by 13 publications

References 2 publications

Distinguishing false from true alerts in Snort by data mining patterns of alerts

Distinguishing false from true alerts in Snort by data mining patterns of alerts

Third line of defense strategy to fight against SMS-based malware in android smartphones

NSL: a network-security-oriented language

Contact Info

Product

Resources

About