Aplicando a Frequência de Episódios na Correlação de Alertas

• Leonardo Vilaça Silva UFPE
• Eduardo Luzeiro Feitosa UFPE / UFAM
• Djamel Sadok UFPE
• Judith Kelner UFPE

DOI: https://doi.org/10.5753/sbseg.2010.20591

Abstract

In the current security situation of computer networks, traffic anomalies generated by many different reasons have affected an increasing portion of the Internet. This paper presents a tool for correlation and prediction of alerts based on frequent episodes technique to detect anomalous traffic. For validation, tests will be done in a controlled environment using DARPA 2000 dataset and real traffic.

References

CERT. (2003) "CERT Advisory CA-2003-20 W32/Blaster worm," http://www.cert.org/advisories/CA-2003-20.html.

Debar, H., Curry, D., and Feinstein, B. (2007) "The Intrusion Detection Message Exchange Format (IDMEF)", RFC 4765, Março. X Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais 253

Feitosa, E. L., Souto, E., e Sadok, D. (2008) "Tráfego Internet não Desejado: Conceitos, Caracterização e Soluções", In Livro-texto de mini-cursos do VIII Simpósio Brazileiro de em Segurança da Informação e Sistemas de Computação (SBSeg'08). Porto Alegre, Brasil: SBC, ch. 3.

Hwang, K., Cai, M., Chen, Y., and Qin, M. (2007) "Hybrid Intrusion Detection with Weighted Signature Generation over Anomalous Internet Episodes", IEEE Transactions on Dependable and Secure Computing, Vol. 4, No. 1, páginas 41-55.

Lee, W., Stolfo, S. J., and Mok, K. (2000) "Adaptive Intrusion Detection: A Data Mining Approach", Artificial Intelligence Reviews, Vol. 14, No. 6, páginas 533-567, December.

Mannila, H., Toivonen, H., e Verk, A. I. (1997) "Discovery of Frequent Episodes in Event Sequences", Data Mining and Knowledge Discovery, Vol. 1, No. 3, páginas 259-289.

MIT. (2000) "2000 DARPA Intrusion Detection Scenario Specific Data Sets", http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html.

Qin, M. e Hwang, K. (2004) "Frequent Episode Rules for Intrusive Anomaly Detection with Internet Data mining", In USENIX Security Symposium, páginas 1-15.

Snort. (2009) "Snort", http://www.snort.org.

Soleimani, M. e Ghorbani, A. A. (2008) "Critical Episode Mining in Intrusion Detection Alerts", In Proceedings of the Communication Networks and Services Research Conference (CNSR), páginas 157-164.

Symantec. (2007) "Outbreak alert: storm trojan", http://www.symantec.com/outbreak/storm_trojan.html. 2007.

Ye, N., Chen, Q., e Borror, C. M. (2004) "EWMA Forecast of Normal System Activity for Computer Intrusion Detection", IEEE Transactions on Reliability, Vol. 53, páginas. 557-566.