UMBC ebiquity
Proceedings of the National Symposium on Moving Target Research
A Semantic Approach to Situational Awareness for Intrusion Detection
June 11, 2012
We describe a situation-aware intrusion detection system that integrates heterogeneous sources of information to build and maintain a semantically rich knowledge-base about cyber threats and vulnerabilities. Most current intrusion detection and prevention systems rely on signature-based approaches to detect attacks. When an attack signature is not available, such as for a new exploit or a significantly modified known one, such systems are much less effective. Moreover, these intrusion detection systems are point-based solutions which do not make effective use of heterogeneous data sources, which can provide im-portant information related to intrusions which are not yet available as signature patterns. This information can also help detect low-and-slow attacks in which small intrusions that are spatially and temporally apart combine to build a more elaborate attack.
For more information, see http://ebiq.org/j/98
InProceedings
National Coordination Office for Networking and Information Technology Research and Development
(poster paper)
Downloads: 3509 downloads