Network Security White Papers
Enhancing Network Intrusion Detection With Integrated Sampling and Filtering
Overview The structure of many standalone Network Intrusion Detection Systems (NIDSs) centers around a chain of analysis that begins with packets captured by a packet filter, where the filter describes the protocols (TCP/UDP port numbers) and sometimes hosts or subnets to include or exclude from the analysis. This paper argues for augmenting such analysis with an additional, separately filtered stream of packets. This "Secondary Path" supplements the "Main Path" by integrating sampling and richer forms of filtering into a NIDS's analysis. It discusses an implementation of a secondary path for the Bro intrusion detection system and enhancements the authors developed to the Berkeley Packet Filter to work in concert with the secondary path.
| Publisher | University of California | File Format | |
|---|---|---|---|
| Date Published | July 2006 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 2 out of 7 users found this white paper useful
White Paper RSS
Download
Register
