Alert correlation in a cooperative intrusion detection framework

By Frédéric Cuppens, Alexandre Miège. Proceedings 2002 IEEE Symposium on Security and Privacy, 2002

817 citations recorded by the source corpus.

Subfields: Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/05aefdb3799fac32076dcd89f9ec6cd468afd16d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

Citations in the corpus

MulVAL: A Logic-based Network Security Analyzer (2005, background): “Intrusion detection systems have been widely deployed in networks and extensively studied in the literature [5, 16, 14].”
Comprehensive approach to intrusion detection alert correlation (2004, methodology): “The approach proposed by Cuppens and Mie`ge in [5] also uses pre and postconditions.”
Scalable, graph-based network vulnerability analysis (2002, methodology): “Cuppens and Miege [3] use a similar approach to model the attacks in the Intrusion Detection Framework.”
Global Intrusion Detection in the DOMINO Overlay System (2004, background): “The inducement for the satellites is a global vantage point that allows for rapid outbreak recognition, dynamic content filtering and application specific source blacklisting to protect their networks in a timely manner.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “Alert correlation modules such as CRIM [13] provide the ability to cluster and correlate similar alerts.”
M2D2: A Formal Data Model for IDS Alert Correlation (2002, methodology): “Cuppens and Miège suggest in [16] to correlate alerts by using attack scenarios specified in the Lambda language [17].”
A Survey of Visualization Systems for Network Security (2012, background): “For this reason, they are placed into bins of 100’s, registered ports (<50;000) are placed into bins of 10,000’s, and the remaining private/dynamic ports (50,000-65,535) are placed into a single bin.”
Internet intrusions: global characteristics and prevalence (2003, background): “cept of developing an infrastructure that would pool resources in order to more rapidly and more effectively respond to attacks and intrusions [6, 10, 22].”
A survey of coordinated attacks and collaborative intrusion detection (2010, background): “Cuppens and Miege (2002) proposed an alert correlation function in a cooperative intrusion detection framework.”