Exchanging Security Events: Which And How Many Alerts Can We Aggregate?

Autoři

HUSÁK Martin ČERMÁK Milan LAŠTOVIČKA Martin VYKOPAL Jan

Rok publikování 2017
Druh Článek ve sborníku
Konference 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)
Fakulta / Pracoviště MU

Ústav výpočetní techniky

Citace
www http://ieeexplore.ieee.org/document/7987340/
Doi http://dx.doi.org/10.23919/INM.2017.7987340
Obor Informatika
Klíčová slova aggregation;security alert;information sharing
Přiložené soubory
Popis The exchange of security alerts is a current trend in network security and incident response. Alerts from network intrusion detection systems are shared among organizations so that it is possible to see the ''big picture'' of current security situation. However, the quality and redundancy of the input data seem to be underrated. We present four use cases of aggregation of the alerts from network intrusion detection systems. Alerts from a sharing platform deployed in the Czech national research and education network were examined in a case study. Volumes of raw and aggregated data are presented and a rule of thumb is proposed: up to 85 % of alerts can be aggregated. Finally, we discuss the practical implications of alert aggregation for the network intrusion detection system, such as (in)completeness of the alerts and optimal time windows for aggregation.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.

Další info