Aggregation and Correlation of Intrusion-Detection Alerts
暂无分享,去创建一个
This paper describes an aggregation and correlation algorithm used in the design and implementation of an intrusion-detection console built on top of the Tivoli Enterprise Console (TEC). The aggregation and correlation algorithm aims at acquiring intrusion-detection alerts and relating them together to expose a more condensed view of the security issues raised by intrusion-detection systems.
[1] Marc Dacier,et al. A Lightweight Tool for Detecting Web Server Attacks , 2000, NDSS.
[2] Wietse Z. Venema,et al. TCP Wrapper: Network Monitoring, Access Control, and Booby Traps , 1992, USENIX Summer.
[3] Marc Dacier,et al. A revised taxonomy for intrusion-detection systems , 2000, Ann. des Télécommunications.