检索结果-内蒙古大学图书馆

54th Annual IEEE Global Telecommunications Conference (GLOBECOM)

作者： Steinert, R. Gestrelius, S. Gillblad, D. Swedish Inst Comp Sci SICS Ind Applicat & Methods Lab IAM SE-16429 Kista Sweden

ISBN: (纸本)9781424492688

We present a distributed spatio-temporal event correlation protocol for multi-layer networks. The problems that we address relate to scalability in stacked overlay networks and network equipment with asynchronous clocks, which complicates the problem of event correlation. We describe a cross-layer protocol designed to address these problems, operating in a fully distributed manner and taking into account asynchronous timestamps. It is assumed that events in one layer may arise from a series of events in lower layers. Detected events that are spatially related in one layer are aggregated using a gossip-like protocol, and constitute a root cause. The set of aggregated events is disseminated to lower layers and used for temporal correlation. We have tested the scalability and the performance of the distributed event protocol, using both synthetically generated and real-world topologies. The results indicate that the average overhead produced for collecting events down the stack of overlays increases with the number of layers. For a fixed number of layers, the protocol scales similarly with the graph-theoretic properties for a network of increasing size.

关键词： distributed event correlation temporal correlation multi-layer networks overlay networks

来源：评论

学校读者我要写书评

暂无评论

Design and Analysis of a Dynamically Configured Log-based distributed Security event Detection Methodology

引用

JOURNAL OF DEFENSE MODELING AND SIMULATION-APPLICATIONS METHODOLOGY TECHNOLOGY-JDMS 2012年第3期9卷 219-241页

作者： Grimaila, Michael R. Myers, Justin Mills, Robert F. Peterson, Gilbert US Air Force Inst Technol Wright Patterson AFB OH 45433 USA

Military and defense organizations rely upon the security of data stored in, and communicated through, their cyber infrastructure to fulfill their mission objectives. It is essential to identify threats to the cyber infrastructure in a timely manner, so that mission risks can be recognized and mitigated. Centralized event logging and correlation is a proven method for identifying threats to cyber resources. However, centralized event logging is inflexible and does not scale well, because it consumes excessive network bandwidth and imposes significant storage and processing requirements on the central event log server. In this paper, we present a flexible, distributed event correlation system designed to overcome these limitations by distributing the event correlation workload across the network of event-producing systems. To demonstrate the utility of the methodology, we model and simulate centralized, decentralized, and hybrid log analysis environments over three accountability levels and compare their performance in terms of detection capability, network bandwidth utilization, database query efficiency, and configurability. The results show that when compared to centralized event correlation, dynamically configured distributed event correlation provides increased flexibility, a significant reduction in network traffic in low and medium accountability environments, and a decrease in database query execution time in the high-accountability case.

关键词： distributed event correlation insider threats log analysis security incident detection

来源：评论

学校读者我要写书评

暂无评论

Intrusion Detection in Cloud Computing

Intrusion Detection in Cloud Computing

引用

8th International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC)

作者： Ficco, Massimo Tasquier, Luca Aversa, Rocco Univ Naples 2 Dipartimento Ingn Ind & Informaz I-81031 Aversa Italy

ISBN: (纸本)9780769550947

Cloud Computing represents both a technology for using computing infrastructures in a more efficient way, and a business model for selling computing resources and services. On the other hand, such complex and distributed architectures become an attractive target for intruders. Cyber-attacks represent a serious danger, which can compromise the quality of service delivered to the customers. In this paper, we investigate the key research topics for supporting distributed intrusion detection in Cloud environments. Moreover, we present a distributed architecture for providing intrusion detection in Cloud Computing, which enables Cloud providers to offer security solutions as a service. It is a hierarchical and multi-layer architecture designed to collect information in the Cloud environment, using multiple distributed security components, which can be used to perform complex event correlation analysis.

关键词： Cloud computing intrusion detection distributed event correlation

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：