CARDS: A Distributed System for Detecting Coordinated Attacks (2000)
Cached
Download Links
- [ise.gmu.edu]
- [www.cs.uvm.edu]
- [www.csc.ncsu.edu]
- DBLP
Other Repositories/Bibliography
| Venue: | IFIP TC11 SIXTEENTH ANNUAL WORKING CONFERENCE ON INFORMATION SECURITY |
| Citations: | 15 - 3 self |
BibTeX
@INPROCEEDINGS{Yang00cards:a,
author = {Jiahai Yang and Peng Ning and X. Sean Wang and Sushil Jajodia},
title = {CARDS: A Distributed System for Detecting Coordinated Attacks},
booktitle = {IFIP TC11 SIXTEENTH ANNUAL WORKING CONFERENCE ON INFORMATION SECURITY},
year = {2000},
pages = {171--180},
publisher = {Kluwer Academic Publishers}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
A major research problem in intrusion detection is the efficient Detection of coordinated attacks over large networks. Issues to be resolved include determining what data should be collected, which portion of the data should be analyzed, where the analysis of the data should take place, and how to correlate multi-source information. This paper proposes the architecture of a Coordinated Attack Response & Detection System (CARDS). CARDS uses a signature-based model for resolving these issues. It consists of signature managers, monitors, and directory services. The system collects data in a flexible, distributed manner, and the detection process is decentralized among various monitors and is event-driven. The paper also discusses related implementation issues.
