| Autor: |
Bartłomiej Balcerek, Piotr Dragan, Bogdan Trawiński, Marcin Wojtkicwicz |
| Rok vydání: |
2007 |
| Předmět: |
|
| Zdroj: |
Communications in Computer and Information Science ISBN: 9783540739852 |
| DOI: |
10.1007/978-3-540-73986-9_28 |
| Popis: |
The investigation of the effectiveness of alert correlation methods implemented in the Alert Correlation Module was presented in the paper. The module was developed within the POSITIF project (Policy-based Security Tools and Framework) funded by the European Commission. Three effectiveness metrics were applied: reduction coefficient average ancestor count in alert trees and percentage of meta-alerts in outgoing alerts. Research was conducted using a test environment comprising 14 computers with IDS installed. Network traffic was monitored for 40 days, and during this time the IDSs generated 211 251 alerts. The module correlated and recognized as dangerous 6994 of them therefore achieving a level of reduction equal to 96.69 percent, which could be regarded as a good results. |
| Databáze: |
OpenAIRE |
| Externí odkaz: |
|
