Re: Views and Correlation in Intrusion Detection

From: adam.w.hogan (adam.w.hogan_at_delphi.com)
Date: 06/23/03

  • Next message: Randy Taylor: "Re: Views and Correlation in Intrusion Detection" 
    Date: Mon, 23 Jun 2003 14:25:40 -0400
To: "Focus-Ids (E-mail)" <focus-ids@securityfocus.com>

    It seems to me that this thread and the 'IDS is dead, etc' thread are both coming to same conclusions. Namely, much more work/research needs to be done in event correlation to efficiently, and effectively, use an IDS. Now, I think we all have realized this at some point. I've been wrestling with the idea for some time now, but the scope of this task is enormous, and I'm not sure where to begin. So I throw this out to the group: how do we start to tackle this problem? Better statistical analysis? An open standard to define event data so it can be manipulated easily? Where does more research need to be done? Everybody's thoughts would be appreciated.

    p.s. - I ask not only as a security engineer tasked with making sense of various security tool interfaces and logs, but also as a student looking to do a thesis related to intrusion detection systems (so any other ideas into needed research would be helpful).

    -Adam W. Hogan

    -------------------------------------------------------------------------------
    Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the
    world's premier technical IT security event! 10 tracks, 15 training sessions,
    1,800 delegates from 30 nations including all of the top experts, from CSO's to
    "underground" security specialists. See for yourself what the buzz is about!
    Early-bird registration ends July 3. This event will sell out. www.blackhat.com
    -------------------------------------------------------------------------------

  • Next message: Randy Taylor: "Re: Views and Correlation in Intrusion Detection"

    Relevant Pages

    • entercept
      ... world's premier technical IT security event! ... 10 tracks, 15 training sessions, ... 1,800 delegates from 30 nations including all of the top experts, from CSO's to ...
      (Focus-IDS)
    • Application level IDS?
      ... hidden-fields tampering, cookie poisoning etc. while ... SBC Yahoo! ... world's premier technical IT security event! ... 10 tracks, 15 training sessions, ...
      (Focus-IDS)
    • Re: Foundry ServerIronXL Question
      ... > Early-bird registration ends July 3. ... This event will sell out. ... world's premier technical IT security event! ... 10 tracks, 15 training sessions, ...
      (Focus-IDS)
    • SMB "sniffer"
      ... L'ADSL à partir de 15,95 EUR/mois et le modem ADSL offert? ... world s premier technical IT security event! ... 10 tracks, 15 training sessions, ...
      (Pen-Test)
    • Correlationtool
      ... does someone knows if there is an opensource tool which can correlate IDS-Data from Snort? ... Regards, ... world's premier technical IT security event! ... 10 tracks, 15 training sessions, ...
      (Focus-IDS)
    • Quantcast