Network Security White Papers
Policy-Controlled Event Management for Distributed Intrusion Detection
Overview A powerful strategy in intrusion detection is the separation of surveillance mechanisms from a site's policy for processing observed events. The Bro intrusion detection system has been using the notion of policy-neutral events as the basic building blocks for the formulation of a site's security policy since its conception. A recent addition to the system is the ability to exchange events with other Bro peers to allow distributed detection. This paper extends Bro's existing event model to fulfill the requirements of scalable policy-controlled distributed event management, including mechanisms for event publication, subscription, processing, propagation, and correlation.
| Publisher | University of Cambridge | File Format | |
|---|---|---|---|
| Date Published | January 2008 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 6 out of 13 users found this white paper useful
White Paper RSS
Download
Register
