Rapid Prototyping of Flow-Based Detection Methods Using Complex Event Processing

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F18%3A00106891" target="_blank" >RIV/00216224:14610/18:00106891 - isvavai.cz</a>

Result on the web

<a href="https://ieeexplore.ieee.org/document/8406121" target="_blank" >https://ieeexplore.ieee.org/document/8406121</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/NOMS.2018.8406121" target="_blank" >10.1109/NOMS.2018.8406121</a>

Result language

angličtina

Original language name

Rapid Prototyping of Flow-Based Detection Methods Using Complex Event Processing

Original language description

Detection of network attacks is the first step to network security. Many different methods for attack detection were proposed in the past. However, descriptions of these methods are often not complete and it is difficult to verify that the actual implementation matches the description. In this demo paper, we propose to use Complex Event Processing (CEP) for developing detection methods based on network flows. By writing the detection methods in an Event Processing Language (EPL), we can address the above-mentioned problems. The SQL-like syntax of most EPLs is easily readable so the detection method is self-documented. Moreover, it is directly executable in the CEP system, which eliminates inconsistencies between documentation and implementation. The demo will show a running example of a multi-stage HTTP brute force attack detection using Esper and its EPL.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/VI20162019029" target="_blank" >VI20162019029: Sharing and analysis of security events in Czech Republic</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2018

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium

ISBN

9781538634165

ISSN

—

e-ISSN

—

Number of pages

3

Pages from-to

1-3

Publisher name

IEEE Xplore Digital Library

Place of publication

Taipei, Taiwan

Event location

Taipei, Taiwan

Event date

Apr 23, 2018

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—