Network Security White Papers
Context-Based Intrusion Detection Using Snort, Nessus and Bugtraq Databases
Overview Intrusion Detection Systems (IDS) use different techniques to reduce the number of false positives they generate. Simple network context information such as the communication session state has been added in IDS signatures to only raise alarms in the proper context. However, this is often not sufficient and more network context information needs to be added to these Stateful IDS (SIDS) signatures to reduce the number of false positives. IDS are also used with other network monitoring systems such as Vulnerability Detection Systems (VDS) and vulnerability databases in centralized correlation systems to determine the importance of an alarm. The correlation mechanism relies on the accuracy of a standardized relationship between IDS signatures, VDS signatures and the vulnerability databases.
| Publisher | Carleton University | File Format | |
|---|---|---|---|
| Date Published | July 2005 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 4 out of 4 users found this white paper useful
White Paper RSS
Download
Register
