A Novel Framework for Alert Correlation and Understanding
暂无分享,去创建一个
[1] Peng Ning,et al. Constructing attack scenarios through correlation of intrusion alerts , 2002, CCS '02.
[2] Steven J. Templeton,et al. A requires/provides model for computer attacks , 2001, NSPW '00.
[3] Ming-Yuh Huang,et al. A large scale distributed intrusion detection framework based on attack strategy analysis , 1999, Comput. Networks.
[4] Marc Dacier,et al. Mining intrusion detection alarms for actionable knowledge , 2002, KDD.
[5] Eugene H. Spafford,et al. A PATTERN MATCHING MODEL FOR MISUSE INTRUSION DETECTION , 1994 .
[6] Peng Ning,et al. Analyzing Intensive Intrusion Alerts via Correlation , 2002, RAID.
[7] Hervé Debar,et al. Aggregation and Correlation of Intrusion-Detection Alerts , 2001, Recent Advances in Intrusion Detection.
[8] Richard A. Kemmerer,et al. State Transition Analysis: A Rule-Based Intrusion Detection Approach , 1995, IEEE Trans. Software Eng..
[9] Kurt Jensen,et al. Coloured Petri nets (2nd ed.): basic concepts, analysis methods and practical use: volume 1 , 1996 .
[10] Qiang Chen,et al. Probabilistic techniques for intrusion detection based on computer audit data , 2001, IEEE Trans. Syst. Man Cybern. Part A.
[11] Stephen Taylor,et al. Validation of Sensor Alert Correlators , 2003, IEEE Secur. Priv..
[12] Robert P. Goldman,et al. Plan recognition in intrusion detection systems , 2001, Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01.
[13] Nong Ye,et al. Information fusion techniques for network intrusion detection , 1998, 1998 IEEE Information Technology Conference, Information Environment for the Future (Cat. No.98EX228).
[14] Frédéric Cuppens,et al. Managing alerts in a multi-intrusion detection environment , 2001, Seventeenth Annual Computer Security Applications Conference.
[15] T. Moon. The expectation-maximization algorithm , 1996, IEEE Signal Process. Mag..
[16] Eugene H. Spafford,et al. A pattern-matching model for intrusion detection , 1994 .
[17] Frédéric Cuppens,et al. Correlation in an intrusion detection process , 2002 .
[18] Alfonso Valdes,et al. Probabilistic Alert Correlation , 2001, Recent Advances in Intrusion Detection.
[19] Peng Ning,et al. Correlating Alerts Using Prerequisites of Intrusions , 2001 .
[20] Gregory L. Frazier,et al. A controller-based autonomic defense system , 2003, Proceedings DARPA Information Survivability Conference and Exposition.
[21] Frédéric Cuppens,et al. Alert correlation in a cooperative intrusion detection framework , 2002, Proceedings 2002 IEEE Symposium on Security and Privacy.
[22] Lars Michael Kristensen,et al. The practitioner’s guide to coloured Petri nets , 1998, International Journal on Software Tools for Technology Transfer.
[23] Kurt Jensen,et al. An Introduction to the Theoretical Aspects of Coloured Petri Nets , 1993, REX School/Symposium.
[24] J. Simonoff. Smoothing Methods in Statistics , 1998 .
[25] Remco C. de Boer. A Generic Architecture for Fusion-Based Intrusion Detection Systems , 2002 .
[26] Klaus Julisch,et al. Mining alarm clusters to improve alarm handling efficiency , 2001, Seventeenth Annual Computer Security Applications Conference.
[27] Sushil Jajodia,et al. Applications of Data Mining in Computer Security , 2002, Advances in Information Security.
[28] Deborah A. Frincke,et al. Planning, Petri Nets, and Intrusion Detection , 1998 .
[29] Kurt Jensen,et al. Coloured Petri Nets: Basic Concepts, Analysis Methods and Practical Use. Vol. 2, Analysis Methods , 1992 .
[30] Stefan Axelsson,et al. The base-rate fallacy and its implications for the difficulty of intrusion detection , 1999, CCS '99.
[31] Robert P. Goldman,et al. Information modeling for intrusion report aggregation , 2001, Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01.
[32] Alfonso Valdes,et al. A Mission-Impact-Based Approach to INFOSEC Alarm Correlation , 2002, RAID.
[33] William L. Fithen,et al. State of the Practice of Intrusion Detection Technologies , 2000 .
[34] Peter G. Neumann,et al. EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances , 1997, CCS 2002.