An Intelligent Intrusion Detection and Response System Using Network Quarantine Channels: Adaptive Policies and Alert Filters

E. Hooper
{"title":"An Intelligent Intrusion Detection and Response System Using Network Quarantine Channels: Adaptive Policies and Alert Filters","authors":"E. Hooper","doi":"10.1109/WI-IATW.2006.41","DOIUrl":null,"url":null,"abstract":"Intrusion detection systems are used to identify suspicious network traffic. However, a high percentage of alerts generated by such systems are liable to be false positives. Since these alerts typically require manual intervention from a network administrator, false positives create considerable administrative overheads. In order to reduce the number of false positives, we propose a new network protection component called a network quarantine channel, which is used to perform some additional interaction with hosts that have been identified as the source of suspicious traffic. The network quarantine channel is used to provide a more accurate assessment of the threat posed by a suspicious host, before alerting the network administrator","PeriodicalId":358971,"journal":{"name":"2006 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology Workshops","volume":"43 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2006-12-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"5","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2006 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology Workshops","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/WI-IATW.2006.41","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 5

Abstract

Intrusion detection systems are used to identify suspicious network traffic. However, a high percentage of alerts generated by such systems are liable to be false positives. Since these alerts typically require manual intervention from a network administrator, false positives create considerable administrative overheads. In order to reduce the number of false positives, we propose a new network protection component called a network quarantine channel, which is used to perform some additional interaction with hosts that have been identified as the source of suspicious traffic. The network quarantine channel is used to provide a more accurate assessment of the threat posed by a suspicious host, before alerting the network administrator
使用网络隔离通道的智能入侵检测和响应系统:自适应策略和警报过滤器
入侵检测系统用于识别可疑的网络流量。然而,这类系统产生的警报中有很大一部分可能是误报。由于这些警报通常需要网络管理员进行人工干预,因此误报会产生相当大的管理开销。为了减少误报的数量,我们提出了一种称为网络隔离通道的新网络保护组件,该组件用于与已确定为可疑流量来源的主机执行一些额外的交互。网络隔离通道用于在向网络管理员发出警报之前,对可疑主机构成的威胁提供更准确的评估
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
自引率
0.00%
发文量
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信