Data Correlation in Intrusion Detection [50 mn de lecture - paru le 8/10/2005 2:44:20 PM - Public : Expert]

Auteur

Ilan NACMIAS Elève-Ingénieur Supinfo Paris Promotion SUPINFO 2005    Lui écrire    Tous les projets de cet auteur    Le mini-CV de cet auteur

Resume

As you know, for several years, the world of computing has been suffering from the same plague :  misdemeanour on the network system. Apart from that I have been involved in the computer security field for many years, and I have decided to use this article to highlight a new method for reducing the problem of network intrusion : Data Correlation.

The challenge of this survey is not to revolutionize the network detection and prevention, but to underline a new relevant method in order to suggest to an analyst, new algorithms, new techniques, and new tools most suited to its problems.

(by Illan NACMIAS)

Sommaire

• INTRODUCTION
• 1 BASIC APPROACH OF DATA CORRELATION
• 1.1 Definition
• 1.2 Main Principle
• 2 WHAT DATA ARE CORRELATED ?
• 2.1 NCSA survey
• 2.1 Relevant selection of instance to correlate
• 3 TECHNIQUES MOST SUITABLE TO CORRELATE EVENTS ?
• 4 STATISTICAL CORRELATION
• 5 BAYESIAN INFERENCE
• 6 ALERT FUSION
• 6.1 Main Principle
• 6.2 Examples
• 6.3 Criteria for a fusion system
• 7 BEST CORRELATION TRADEOFF
• 7.1 Real-time correlation
• 7.2 After-the-fact correlation
• 7.3 Real-time correlation versus After-the-fact correlation
• 8  AGENTS IN AN INTELLIGENT INTRUSION DETECTION ARCHITECTURE
• 8.1 Agent
• 8.2 Advantages to use Agents
• 8.3 Architecture
• CONCLUSION