Rapid Prototyping of Flow-Based Detection Methods Using Complex Event Processing

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F18%3A00106891" target="_blank" >RIV/00216224:14610/18:00106891 - isvavai.cz</a>

Výsledek na webu

<a href="https://ieeexplore.ieee.org/document/8406121" target="_blank" >https://ieeexplore.ieee.org/document/8406121</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/NOMS.2018.8406121" target="_blank" >10.1109/NOMS.2018.8406121</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Rapid Prototyping of Flow-Based Detection Methods Using Complex Event Processing

Popis výsledku v původním jazyce

Detection of network attacks is the first step to network security. Many different methods for attack detection were proposed in the past. However, descriptions of these methods are often not complete and it is difficult to verify that the actual implementation matches the description. In this demo paper, we propose to use Complex Event Processing (CEP) for developing detection methods based on network flows. By writing the detection methods in an Event Processing Language (EPL), we can address the above-mentioned problems. The SQL-like syntax of most EPLs is easily readable so the detection method is self-documented. Moreover, it is directly executable in the CEP system, which eliminates inconsistencies between documentation and implementation. The demo will show a running example of a multi-stage HTTP brute force attack detection using Esper and its EPL.

Název v anglickém jazyce

Rapid Prototyping of Flow-Based Detection Methods Using Complex Event Processing

Popis výsledku anglicky

Detection of network attacks is the first step to network security. Many different methods for attack detection were proposed in the past. However, descriptions of these methods are often not complete and it is difficult to verify that the actual implementation matches the description. In this demo paper, we propose to use Complex Event Processing (CEP) for developing detection methods based on network flows. By writing the detection methods in an Event Processing Language (EPL), we can address the above-mentioned problems. The SQL-like syntax of most EPLs is easily readable so the detection method is self-documented. Moreover, it is directly executable in the CEP system, which eliminates inconsistencies between documentation and implementation. The demo will show a running example of a multi-stage HTTP brute force attack detection using Esper and its EPL.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/VI20162019029" target="_blank" >VI20162019029: Sdílení a analýza bezpečnostních událostí v ČR</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2018

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium

ISBN

9781538634165

ISSN

—

e-ISSN

—

Počet stran výsledku

3

Strana od-do

1-3

Název nakladatele

IEEE Xplore Digital Library

Místo vydání

Taipei, Taiwan

Místo konání akce

Taipei, Taiwan

Datum konání akce

23. 4. 2018

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—