Exchanging Security Events: Which And How Many Alerts Can We Aggregate?

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F17%3A00094466" target="_blank" >RIV/00216224:14610/17:00094466 - isvavai.cz</a>

Result on the web

<a href="http://ieeexplore.ieee.org/document/7987340/" target="_blank" >http://ieeexplore.ieee.org/document/7987340/</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.23919/INM.2017.7987340" target="_blank" >10.23919/INM.2017.7987340</a>

Result language

angličtina

Original language name

Exchanging Security Events: Which And How Many Alerts Can We Aggregate?

Original language description

The exchange of security alerts is a current trend in network security and incident response. Alerts from network intrusion detection systems are shared among organizations so that it is possible to see the ''big picture'' of current security situation. However, the quality and redundancy of the input data seem to be underrated. We present four use cases of aggregation of the alerts from network intrusion detection systems. Alerts from a sharing platform deployed in the Czech national research and education network were examined in a case study. Volumes of raw and aggregated data are presented and a rule of thumb is proposed: up to 85 % of alerts can be aggregated. Finally, we discuss the practical implications of alert aggregation for the network intrusion detection system, such as (in)completeness of the alerts and optimal time windows for aggregation.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/VI20162019029" target="_blank" >VI20162019029: Sharing and analysis of security events in Czech Republic</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2017

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)

ISBN

9783901882890

ISSN

—

e-ISSN

—

Number of pages

4

Pages from-to

604-607

Publisher name

IEEE

Place of publication

Lisbon

Event location

Lisbon

Event date

May 8, 2017

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—