download0 view785
twitter facebook

공공누리This item is licensed Korea Open Government License

Title
A Fusion Framework of IDS Alerts and Darknet Traffic for Effective Incident Monitoring and Response
Author(s)
최상수박학수
Publication Year
2013-12-31
Abstract
Most organizations deploy and operate intrusion detection systems (IDSs) in order to cope with cyber attacks. However, in many cases, it is very difficult to not only analyze IDS alerts in realtime, but also identify real cyber attacks with a high detection accuracy because IDSs record the tremendous amount of alerts and most of them are false positives. Many approaches have been proposed to solve this issue, but there is a limitation in that they have focused on dealing with only IDS alerts. Therefore, in this paper, we propose a fusion framework of IDS alerts and darknet traffic, which is aiming at improving the effectiveness of the incident monitoring and response process. The experimental results show that the proposed framework could detect real cyber attacks that were not detected by IDSs and to identify more dangerous IDS alerts related to real cyber attacks.
Keyword
IDS Alerts; Darknet Traffic; Fusion Framework; Incident Monitoring and Response
Journal Title
Applied mathematics & information sciences : an international journal
ISSN
1935-0090
Files in This Item:
There are no files associated with this item.
Appears in Collections:
7. KISTI 연구성과 > 학술지 발표논문
URI
https://repository.kisti.re.kr/handle/10580/14131
Export
RIS (EndNote)
XLS (Excel)
XML

Browse