Decision Support for Intrusion Detection Data Collection
Paper in proceedings, 2008

Data collection is a critical but difficult activity for intrusion detection. The amount of resources that must be monitored and the rate at which events are generated makes it impossible to use an exhaustive collection strategy. Furthermore, selection and configuration of data collection mechanisms is a tedious and elaborate task for both designers and operators. Therefore, we propose a decision support system (DSS) for selecting and configuring data collection mechanisms. We suggest a generic system model for selecting data collection mechanisms based on the amount of excess data produced. We also provide an implementation of the system. The DSS reduces effort, time, and expertise required in the selection process, and allows both designers and operators to focus on intrusion detection rather than selection and configuration of data collection mechanisms.

intrusion detection

adaptive security

decision support

logging

data collection

Author

Ulf Larson

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Stefan Lindskog

Dennis Nilsson

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Erland Jonsson

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Proceedings of the 13th Nordic Workshop on Secure IT-systems (NordSec 2008), October 9-10, 2008, Copenhagen, Denmark

Subject Categories

Computer Engineering

More information

Created

10/6/2017