NDLI: A New Approach to Building a Multi-tier Direct Access Knowledgebase for IDS/SIEM Systems

Content Provider	IEEE Xplore Digital Library
Author	Azodi, A. Jaeger, D. Feng Cheng Meinel, C.
Copyright Year	2013
Description	Author affiliation: Plattner Inst. (HPI), Univ. of Potsdam, Potsdam, Germany (Azodi, A.; Jaeger, D.; Feng Cheng; Meinel, C.)
Abstract	Looking at current IDS and SIEM systems, we observe heavy processing power dedicated solely to answering a simple question, What is the format of the log line that the IDS (or SIEM) system should process next? Due to the apparent difficulties of uniquely identifying a log line at run-time, most systems today do little or no normalisation of the events they receive. Indeed these systems often rely on popular search engine applications for processing and analysing the event information they receive, which results in slower and far less accurate event correlations. In this process, a large list of tokenisers is usually created in order to find an answer to the above posted question. The tokenisers are run against the log lines, until a match is found. The appropriate log line can then be passed on to the correct extraction module for further processing. This process is currently the standard procedure of most IDS and SIEM systems. To address this problem and to optimise and improve the said process, this paper describes a method for detecting the exact type and format of a read log line in the first place. The method presented performs in an efficient manner, while it is less resource hungry. The proposed detection system is described and implemented, its pros and cons are analysed and weighed against methods currently implemented by popular IDS and SIEM systems for solving this task.
Starting Page	118
Ending Page	123
File Size	766462
Page Count	6
File Format	PDF
e-ISBN	9781479933815
DOI	10.1109/DASC.2013.48
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2013-12-21
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Algorithm design and analysis Intrusion Detection Security Event Information System Natural Language Processing Event Normalisation Event Correlation Data mining Indexes Servers Security Standards Security Event Monitor- ing Security Analytics
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Pushing the Limits in Event Normalisation to Improve Attack Detection in IDS/SIEM Systems

Multi-core Supported High Performance Security Analytics

A big data analytics based approach to anomaly detection

Complex Event Processing based Hybrid Intrusion Detection System

Active event correlation in Bro IDS to detect multi-stage attacks

SIEM approach for a higher level of IT security in enterprise networks

Effective event description using trend template language and efficient intrusion detection

Intelligent monitoring with background knowledge

Online Mining Intrusion Patterns from IDS Alerts

A New Approach to Building a Multi-tier Direct Access Knowledgebase for IDS/SIEM Systems

Similar Documents

Pushing the Limits in Event Normalisation to Improve Attack Detection in IDS/SIEM Systems

Multi-core Supported High Performance Security Analytics

A big data analytics based approach to anomaly detection

Complex Event Processing based Hybrid Intrusion Detection System

Active event correlation in Bro IDS to detect multi-stage attacks

SIEM approach for a higher level of IT security in enterprise networks

Effective event description using trend template language and efficient intrusion detection

Intelligent monitoring with background knowledge

Online Mining Intrusion Patterns from IDS Alerts

A New Approach to Building a Multi-tier Direct Access Knowledgebase for IDS/SIEM Systems