A Query Facility for Common Intrusion Detection Framework

A Query Facility for Common Intrusion Detection Framework (2000)

Cached

Download Links

[www.csc.ncsu.edu]

by Peng Ning , X. Sean Wang , Sushil Jajodia

Venue:	In Proceedings of the 23rd National Information Systems Security Conference
Citations:	5 - 2 self

Versions

Version History

Metadata Version 3

User correction supplied by SystemCorrections

Datum	Value	Source
TITLE	A Query Facility for Common Intrusion Detection Framework	user correction - Legacy Corrections
AUTHOR NAME	Peng Ning	SVM HeaderParse 0.1
AUTHOR AFFIL	Center for Secure Information Systems; George Mason University, Fairfax	SVM HeaderParse 0.2
AUTHOR ADDR	VA 22030, USA	SVM HeaderParse 0.1
AUTHOR NAME	X. Sean Wang	SVM HeaderParse 0.1
AUTHOR AFFIL	Center for Secure Information Systems; George Mason University, Fairfax	SVM HeaderParse 0.2
AUTHOR ADDR	VA 22030, USA	SVM HeaderParse 0.1
AUTHOR NAME	Sushil Jajodia	SVM HeaderParse 0.1
AUTHOR AFFIL	Center for Secure Information Systems; George Mason University, Fairfax	SVM HeaderParse 0.2
AUTHOR ADDR	VA 22030, USA	SVM HeaderParse 0.1
ABSTRACT	It is essential for intrusion detection systems to share information in order to discover attacks involving multiple sites. Common Intrusion Detection Framework (CIDF) is an important step towards enabling different intrusion detection and response (IDR) components to interoperate with each other. Although CIDF provides an infrastructure and language support that allows an IDR component to understand the information sent by another component, it does not contain a facility for a component to request specific information from other components. The lack of such a facility may result in a waste of processing time, storage capacity and network bandwidth. This paper proposes an extension to the Common Intrusion Specification Language (CISL), the language adopted by CIDF, to model requests among CIDF components. The extension is simple and consistent with the original CISL. Each request for information is described as a pattern for relevant information and an optional format specification for the responding message. The use of pattern in modeling requests not only provides a way to represent queries, but also leads to a potential reuse of signature-based intrusion detection software.	user correction - Legacy Corrections
YEAR	2000	INFERENCE
VENUE	In Proceedings of the 23rd National Information Systems Security Conference	INFERENCE
VENUE TYPE	CONFERENCE	INFERENCE
PAGES	317--328	INFERENCE
CITATIONS	14 found	ParsCit 1.0