GrIDS - A Graph Based Intrusion Detection System For Large Networks

GrIDS - A Graph Based Intrusion Detection System For Large Networks (1996)

Cached

Download Links

by S. Staniford-chen , S. Cheung , R. Crawford , M. Dilger , J. Frank , J. Hoagl , K. Levitt , C. Wee , R. Yip , D. Zerkle

Venue:	In Proceedings of the 19th National Information Systems Security Conference
Citations:	83 - 2 self

Versions

Version History

Metadata Version 1

Datum	Value	Source
TITLE	GrIDS - A Graph Based Intrusion Detection System For Large Networks	INFERENCE
AUTHOR NAME	S. Staniford-chen	SVM HeaderParse 0.2
AUTHOR NAME	S. Cheung	SVM HeaderParse 0.2
AUTHOR NAME	R. Crawford	SVM HeaderParse 0.2
AUTHOR NAME	M. Dilger	SVM HeaderParse 0.2
AUTHOR NAME	J. Frank	SVM HeaderParse 0.2
AUTHOR NAME	J. Hoagl	SVM HeaderParse 0.2
AUTHOR NAME	K. Levitt	SVM HeaderParse 0.2
AUTHOR NAME	C. Wee	SVM HeaderParse 0.2
AUTHOR NAME	R. Yip	SVM HeaderParse 0.2
AUTHOR NAME	D. Zerkle	SVM HeaderParse 0.2
ABSTRACT	There is widespread concern that large-scale malicious attacks on computer networks could cause serious disruption to network services. We present the design of GrIDS (Graph-Based Intrusion Detection System). GrIDS collects data about activity on computers and network tra c between them. It aggregates this information into activity graphs which reveal the causal structure of network activity. This allows large-scale automated orco-ordinated attacks to be detected innear real-time. In addition, GrIDS allows network administrators to state policies specifying which users may use particular services of individual hosts or groups of hosts. By analyzing the characteristics of the activity graphs, GrIDS detects and reports violations of the stated policy. GrIDS uses a hierarchical reduction scheme for the graph construction, which allows it to scale to large networks. An early prototype of GrIDS has successfully detected a worm attack.	SVM HeaderParse 0.2
YEAR	1996	INFERENCE
VENUE	In Proceedings of the 19th National Information Systems Security Conference	INFERENCE
VENUE TYPE	CONFERENCE	INFERENCE
PAGES	361--370	INFERENCE
VOLUME	1	INFERENCE
CITATIONS	12 found	ParsCit 1.0