Intrusion Detection and Correlation: Challenges and Solutions (Advances in Information Security) by Christopher Kruegel, Fredrik

Valeur, Giovanni Vigna ;
Publisher: Springer; 1 edition (November 12, 2004) | ISBN-10: 0387233989 | PDF | 2,6 Mb | 122 pages


Intrusion Detection and Correlation: Challenges and Solutions presents intrusion detection systems (IDSs) and addresses the

problem of managing and correlating the alerts produced. This volume discusses the role of intrusion detection in the realm of

network security with comparisons to traditional methods such as firewalls and cryptography.
The Internet is omnipresent and companies have increasingly put critical resources online.;This has given rise to the activities of

cyber criminals. Virtually all organizations face increasing threats to their networks and the services they provide.;Intrusion

detection systems (IDSs) take increased pounding for failing to meet the expectations researchers and IDS vendors continually

raise.;Promises that IDSs are capable of reliably identifying malicious activity in large networks were premature and never tuned

into reality.
While virus scanners and firewalls have visible benefits and remain virtually unnoticed during normal operations, the situation is

different with intrusion detection sensors.;State-of-the-art IDSs produce hundreds or even thousands of alerts every

day.;Unfortunately, almost all of these alerts are false positives, that is, they are not related to security-relevant incidents.
Intrusion Detection and Correlation: Challenges and Solutions analyzes the challenges in interpreting and combining (i.e.,

correlating) alerts produced by these systems.;In addition, existing academic and commercial systems are classified; their

advantage and shortcomings are presented, especially in the case of deployment in large, real-world sites.