Managing alerts in a multi-intrusion detection environment

By Frédéric Cuppens. Seventeenth Annual Computer Security Applications Conference, 2001

306 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Alert correlation in a cooperative intrusion detection framework (2002, methodology): “As presented in [ 3 ], a relation of similarity connects alerts belonging to the same cluster.”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, methodology): “These local agents act as host monitors and generate alerts whenever malicious activity is detected, which also includes a classiﬁcation of the type of the detected attack.”
M2D2: A Formal Data Model for IDS Alert Correlation (2002, methodology): “In [ 15 ,16], Cuppens and Miµege base their work on fusion on the IDMEF data model [12], implemented as Prolog predicates.”
Constructing attack scenarios through correlation of intrusion alerts (2002, methodology): “, Spice [17], the probabi listic alert correlation [19], and the MIRADOR method [4]) correlates alerts based on the similarities bet we n alert attributes.”
A survey of coordinated attacks and collaborative intrusion detection (2010, methodology): “Cuppens (2001) proposed a clustering based method for alert correlation.”
Global Intrusion Detection in the DOMINO Overlay System (2004, background): “The representation of the satellites allows the network wider coverage across the IP space.”