NDLI: A Flexible and Efficient Alert Correlation Platform for Distributed IDS

Content Provider	IEEE Xplore Digital Library
Author	Roschke, S. Feng Cheng Meinel, C.
Copyright Year	2010
Abstract	Intrusion Detection Systems (IDS) have been widely deployed in practice for detecting malicious behavior on network communication and hosts. The problem of false-positive alerts is a popular existing problem for most of IDS approaches. The solution to address this problem is correlation and clustering of alerts. To meet the practical requirements, this process needs to be finished as soon as possible, which is a challenging task as the amount of alerts produced in large scale deployments of distributed IDS is significantly high. We identify the data storage and processing algorithms to be the most important factors influencing the performance of clustering and correlation. We propose and implement the utilization of memory-supported algorithms and a column-oriented database for correlation and clustering in an extensible IDS correlation platform. The utilization of the column-oriented database, an In-Memory Alert Storage, and memory-based index tables leads to significant improvements on the performance. Different types of correlation modules can be integrated and compared on this platform. A plugin concept for Receivers provides flexible integration of various sensors and additional IDS management systems. The platform can be distributed over multiple processing units to share memory and processing power. A standardized interface is designed to provide a unified view of result reports for end users. The efficiency of the proposed platform is tested by practical experiments with several alert storage approaches, different simple algorithms, as well as local and distributed deployment.
Starting Page	24
Ending Page	31
File Size	1570700
Page Count	8
File Format	PDF
ISBN	9781424484843
DOI	10.1109/NSS.2010.26
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2010-09-01
Publisher Place	Australia
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Correlation Memory-based Correlation Memory management Clustering algorithms Memory-based Clustering Memory-based Databases IDS Management Sensors Indexes IP networks
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Alert Correlation Using a Novel Clustering Approach

Alert correlation framework using a novel clustering approach

Mining of Attack Models in IDS Alerts from Network Backbone by a Two-stage Clustering Method

A new system to evaluate GA-based clustering algorithms in Intrusion Detection alert management system

A Flexible and Efficient Alert Correlation Platform for (2010)

Alert Fusion Based on Cluster and Correlation Analysis

Spatial Data Correlation Based Clustering Algorithms for Wireless Sensor Networks

A distributed intrusion detect model based on alert data correlation analysis

Spatial data estimation in three dimensional distributed wireless sensor networks

A Flexible and Efficient Alert Correlation Platform for Distributed IDS

Similar Documents

Alert Correlation Using a Novel Clustering Approach

Alert correlation framework using a novel clustering approach

Mining of Attack Models in IDS Alerts from Network Backbone by a Two-stage Clustering Method

A new system to evaluate GA-based clustering algorithms in Intrusion Detection alert management system

A Flexible and Efficient Alert Correlation Platform for (2010)

Alert Fusion Based on Cluster and Correlation Analysis

Spatial Data Correlation Based Clustering Algorithms for Wireless Sensor Networks

A distributed intrusion detect model based on alert data correlation analysis

Spatial data estimation in three dimensional distributed wireless sensor networks

A Flexible and Efficient Alert Correlation Platform for Distributed IDS