Exchanging Security Events: Which And How Many Alerts Can We Aggregate?

Publikace nespadá pod Filozofickou fakultu, ale pod Ústav výpočetní techniky. Oficiální stránka publikace je na webu muni.cz.



Rok publikování 2017
Druh Článek ve sborníku
Konference 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)
Fakulta / Pracoviště MU

Ústav výpočetní techniky

www http://ieeexplore.ieee.org/document/7987340/
Doi http://dx.doi.org/10.23919/INM.2017.7987340
Obor Informatika
Klíčová slova aggregation;security alert;information sharing
Přiložené soubory
Popis The exchange of security alerts is a current trend in network security and incident response. Alerts from network intrusion detection systems are shared among organizations so that it is possible to see the ''big picture'' of current security situation. However, the quality and redundancy of the input data seem to be underrated. We present four use cases of aggregation of the alerts from network intrusion detection systems. Alerts from a sharing platform deployed in the Czech national research and education network were examined in a case study. Volumes of raw and aggregated data are presented and a rule of thumb is proposed: up to 85 % of alerts can be aggregated. Finally, we discuss the practical implications of alert aggregation for the network intrusion detection system, such as (in)completeness of the alerts and optimal time windows for aggregation.
Související projekty: