Automating Network Security Analysis at Packet-level by using Rule-based Engine
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F19%3APU135007" target="_blank" >RIV/00216305:26230/19:PU135007 - isvavai.cz</a>
Result on the web
<a href="https://www.fit.vut.cz/research/publication/12011/" target="_blank" >https://www.fit.vut.cz/research/publication/12011/</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1145/3352700.3352714" target="_blank" >10.1145/3352700.3352714</a>
Alternative languages
Result language
angličtina
Original language name
Automating Network Security Analysis at Packet-level by using Rule-based Engine
Original language description
When a network incident is detected, a network administrator has to manually verify the incident and provide a solution to stop the incident from continuing and prevent similar incidents in the future. The network analysis is a time-consuming and labor-intensive activity which requires good network knowledge. Creating a solution which automates the administrator's work can dramatically speed up the analysis process and can make the whole process easier for less experienced administrators. In this paper, we describe a method that uses a predefined set of rules to identify incident patterns. Though this principle is used by many security tools, the new aspect is that the presented approach uses the Wireshark tool which is well known among the administrators, and it is expressive enough to specify complex relations among source data thus being able to detect quite sophisticated attacks. The created rule's format uses the same language as the Wireshark filters.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
—
Continuities
S - Specificky vyzkum na vysokych skolach
Others
Publication year
2019
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
Proceedings of the Sixth European Conference on the Engineering of Computer-Based Systems
ISBN
978-1-4503-7636-5
ISSN
—
e-ISSN
—
Number of pages
8
Pages from-to
1-8
Publisher name
Association for Computing Machinery
Place of publication
Bucharest
Event location
Bucharest
Event date
Sep 2, 2019
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
000525376600014