Security Tools White Papers
Dependency-Based Distributed Intrusion Detection
Overview Distributed network intrusion detection has attracted much attention recently. The main focus in this work is on zero-day, slow-scanning worms, of which no existing signatures are available. End hosts are organized into regions based on network knowledge, which it posits is positively correlated to the dependency structure. Leveraging on this organization, different intrusion detection techniques are applied within and across regions. A Hidden Markov Model (HMM) is used within a region to capture the dependency among hosts, and use Sequential Hypothesis Testing (SHT) globally to take advantage of the independence between regions.
| Publisher | Massachusetts Institute of Technology | File Format | |
|---|---|---|---|
| Date Published | December 2007 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 4 out of 9 users found this white paper useful
White Paper RSS
Download
Register
