NDLI: Information modeling for intrusion report aggregation

Content Provider	IEEE Xplore Digital Library
Author	Goldman, R.P. Heimerdinger, W. Harp, S.A. Geib, C.W. Thomas, V. Carter, R.L.
Copyright Year	2001
Description	Author affiliation: Honeywell Labs, Minneapolis, MN, USA (Goldman, R.P.)
Abstract	The paper describes the SCYLLARUS approach to fusing reports from multiple intrusion detection systems (ID-Ses) to provide an overall approach to intrusion situation awareness. The overall view provided by SCYLLARUS centers around the site's security goals, aggregating large numbers of individual IDS reports based on their impact. The overall view reduces information overload by aggregating multiple IDS reports in a rep-down view; and by reducing false positives by weighing evidence provided by multiple ID-Ses and other information sources. Unlike previous efforts in this area, SCYLLARUS is centered around its intrusion reference model (IRM). The SCYLLARUS IRM contains both dynamic and static (configuration) information. A network entity/relationship database (NERD), providing information about the site's hardware and software; a security goal database, describing the site's objectives and security policy; and an event dictionary, describing important events, both intrusions and benign; comprise the static portion of the IRM. The set of IDS reports; the events SCYLLARUS hypothesizes to explain them; and the resulting judgment of the state of site security goals comprise the dynamic part of the IRM.
Sponsorship	DARPA
Starting Page	329
Ending Page	342
File Size	1232532
Page Count	14
File Format	PDF
ISBN	0769512127
DOI	10.1109/DISCEX.2001.932228
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2001-06-12
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intrusion detection Information security Data security Databases Laboratories Hardware Dictionaries Prototypes Sensor systems Costs
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Multi-level alert clustering for intrusion detection sensor data

Adaptive critic designs for host-based intrusion detection

DAIS: a real-time data attack isolation system for commercial database applications

RECON-a tool for incident detection, tracking and response

Secure data aggregation and intrusion detection in wireless sensor networks

Intrusion detection in virtual machine environments

Intrusion Detection Force: an infrastructure for Internet-scale intrusion detection

Towards Survivable Sensor Networks Using Self-Regenerative Rejuvenation and Reconfiguration

A Practical Database Intrusion Detection System Framework

Information modeling for intrusion report aggregation

Similar Documents

Multi-level alert clustering for intrusion detection sensor data

Adaptive critic designs for host-based intrusion detection

DAIS: a real-time data attack isolation system for commercial database applications

RECON-a tool for incident detection, tracking and response

Secure data aggregation and intrusion detection in wireless sensor networks

Intrusion detection in virtual machine environments

Intrusion Detection Force: an infrastructure for Internet-scale intrusion detection

Towards Survivable Sensor Networks Using Self-Regenerative Rejuvenation and Reconfiguration

A Practical Database Intrusion Detection System Framework

Information modeling for intrusion report aggregation