This work describes a solution for intrusion detection that presents an improved operational efficacy ' both in terms of performance as well as volume of processed data ' reducing at the same time the number of false negative and false positive results. For that purpose we correlate the data collected by the intrusion detection system with other data sources, such as events that are reported by interfacing equipment (edge devices) as well as other agents considered crucial for this purpose such as vulnerability detection solutions. As part of the proposed solution the data is collected in a Relational Data base System, to facilitate data correlation, as well as making it available through an easy to use web interface. Additionally, the system interacts with the network managers, in response to pre-defined triggers using a unified messaging platform that uses tools capable of processing E-Mails, Text Messages and also an instant messaging tool based of the XMPP protocol.
Subject
Network Management and Security
Conference
International Conference on Networking and Services - ICNS\'06, July 2006
Cited by
Year 2009 : 2 citations
Sourour Meharouech, Adel Bouhoula, Tarek Abbes, A security policy and Network Cartography based Intrusion Detection and Prevention Systems, Journal of Information Assurance and Security 4 (2009) 279-291, Received June 10, 2009 1554-1010 $ 03.50 Dynamic Publishers, Inc
Lexi Pimenidis, Benedikt Westermann, Volker Wetzelaer, A Context Aware Network-IDS, University of Siegen, Germany, 2009
