Abstract
This paper describes an aggregation and correlation algorithm used in the design and implementation of an intrusion-detection console built on top of the Tivoli Enterprise Console (TEC). The aggregation and correlation algorithm aims at acquiring intrusion-detection alerts and relating them together to expose a more condensed view of the security issues raised by intrusion-detection systems.
This work was performed while employed by the IBM Zurich Research Laboratory.
This work was partially supported by the European IST Project MAFTIA (IST- 1999-11583). However, it represents the view of the author. The MAFTIA project is partially funded by the European Commission and the Swiss Department for Education and Science.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Magnus Almgren, Hervé Debar, and Marc Dacier. A lightweight tool for detecting web server attacks. In Symposium on Network and Distributed Systems Security (NDSS’ 00), pages 157–170, San Diego, CA, February 2000. Internet Society.
Taurus Bey. Tec rules: Planning for efficiency. The Managed View, 3(2):5–20, Spring 1999.
Hervé Debar, Marc Dacier, and Andreas Wespi. A revised taxonomy for intrusiondetection systems. Annales des télécommunications, 55 (7-8):361–378, July-August 2000.
IBM International Technical Support Organization. Early Experiences with Tivoli Enterprise Console 3.7, November 2000. IBM Redbook SG24-6015-00.
IBM International Technical Support Organization. Tivoli SecureWay Risk Manager: Correlating Enterprise Risk Management, November 2000. IBM Redbook SG24-6021-00.
Tivoli Systems. Tivoli SecureWay Risk Manager, User’s Guide, Version 3.7, December 2000.
Tivoli Systems. TME 10 Enterprise Console, User’s Guide, Version 3.7, November 2000.
Wietse Venema. TCP WRAPPER: Network monitoring, access control and booby traps. In UNIX Security III Symposium, pages 85–92, Baltmore, MD, September 1992. Usenix.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2001 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Debar, H., Wespi, A. (2001). Aggregation and Correlation of Intrusion-Detection Alerts. In: Lee, W., Mé, L., Wespi, A. (eds) Recent Advances in Intrusion Detection. RAID 2001. Lecture Notes in Computer Science, vol 2212. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45474-8_6
Download citation
DOI: https://doi.org/10.1007/3-540-45474-8_6
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-42702-5
Online ISBN: 978-3-540-45474-8
eBook Packages: Springer Book Archive