Proceedings of the National Symposium on Moving Target Research

A Semantic Approach to Situational Awareness for Intrusion Detection

, , , and

We describe a situation-aware intrusion detection system that integrates heterogeneous sources of information to build and maintain a semantically rich knowledge-base about cyber threats and vulnerabilities. Most current intrusion detection and prevention systems rely on signature-based approaches to detect attacks. When an attack signature is not available, such as for a new exploit or a significantly modified known one, such systems are much less effective. Moreover, these intrusion detection systems are point-based solutions which do not make effective use of heterogeneous data sources, which can provide im-portant information related to intrusions which are not yet available as signature patterns. This information can also help detect low-and-slow attacks in which small intrusions that are spatially and temporally apart combine to build a more elaborate attack.



For more information, see http://ebiq.org/j/98


  • 5973503 bytes

  • 76552 bytes

cybersecurity, ids, intrusion detection

InProceedings

National Coordination Office for Networking and Information Technology Research and Development

(poster paper)

Downloads: 1896 downloads

UMBC ebiquity