Exchanging Security Events: Which And How Many Alerts Can We Aggregate?

This publication doesn't include Faculty of Arts. It includes Institute of Computer Science. Official publication website can be found on muni.cz.

Authors

HUSÁK Martin ČERMÁK Milan LAŠTOVIČKA Martin VYKOPAL Jan

Year of publication 2017
Type Article in Proceedings
Conference 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)
MU Faculty or unit

Institute of Computer Science

Citation
Web http://ieeexplore.ieee.org/document/7987340/
Doi http://dx.doi.org/10.23919/INM.2017.7987340
Field Informatics
Keywords aggregation;security alert;information sharing
Attached files
Description The exchange of security alerts is a current trend in network security and incident response. Alerts from network intrusion detection systems are shared among organizations so that it is possible to see the ''big picture'' of current security situation. However, the quality and redundancy of the input data seem to be underrated. We present four use cases of aggregation of the alerts from network intrusion detection systems. Alerts from a sharing platform deployed in the Czech national research and education network were examined in a case study. Volumes of raw and aggregated data are presented and a rule of thumb is proposed: up to 85 % of alerts can be aggregated. Finally, we discuss the practical implications of alert aggregation for the network intrusion detection system, such as (in)completeness of the alerts and optimal time windows for aggregation.
Related projects: