Collaborative Approach to Network Behavior Analysis Based on Hardware-Accelerated FlowMon Probes

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F09%3A00164573" target="_blank" >RIV/68407700:21230/09:00164573 - isvavai.cz</a>

Výsledek na webu

—

DOI - Digital Object Identifier

—

Jazyk výsledku

angličtina

Název v původním jazyce

Collaborative Approach to Network Behavior Analysis Based on Hardware-Accelerated FlowMon Probes

Popis výsledku v původním jazyce

Network behavior analysis techniques are designed to detect intrusions and other undesirable behavior in computer networks by analyzing the tra_c statistics. We present an e_cient framework for integration of anomaly detection algorithms working on the identical input data. This framework is based on high-speed network tra_c acquisition subsystem and on trust modeling, a well-established set of techniques from the multi-agent system _eld. Trust-based integration of algorithms results in classi_cation with lower error rate, especially in terms of false positives. The presented system is suitable for both online and o_ine processing, and introduces a relatively low computational overhead compared to deployment of isolated anomaly detection algorithms.

Název v anglickém jazyce

Collaborative Approach to Network Behavior Analysis Based on Hardware-Accelerated FlowMon Probes

Popis výsledku anglicky

Network behavior analysis techniques are designed to detect intrusions and other undesirable behavior in computer networks by analyzing the tra_c statistics. We present an e_cient framework for integration of anomaly detection algorithms working on the identical input data. This framework is based on high-speed network tra_c acquisition subsystem and on trust modeling, a well-established set of techniques from the multi-agent system _eld. Trust-based integration of algorithms results in classi_cation with lower error rate, especially in terms of false positives. The presented system is suitable for both online and o_ine processing, and introduces a relatively low computational overhead compared to deployment of isolated anomaly detection algorithms.

Druh

J_x - Nezařazeno - Článek v odborném periodiku (Jimp, Jsc a Jost)

CEP obor

JC - Počítačový hardware a software

OECD FORD obor

—

Projekt

—

Návaznosti

Z - Vyzkumny zamer (s odkazem do CEZ)

Rok uplatnění

2009

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název periodika

International Journal of Electronic Security and Digital Forensics

ISSN

1751-911X

e-ISSN

—

Svazek periodika

2

Číslo periodika v rámci svazku

1

Stát vydavatele periodika

CH - Švýcarská konfederace

Počet stran výsledku

14

Strana od-do

—

Kód UT WoS článku

—

EID výsledku v databázi Scopus

—