Decision Support for Intrusion Detection Data Collection
Paper i proceeding, 2008

Data collection is a critical but difficult activity for intrusion detection. The amount of resources that must be monitored and the rate at which events are generated makes it impossible to use an exhaustive collection strategy. Furthermore, selection and configuration of data collection mechanisms is a tedious and elaborate task for both designers and operators. Therefore, we propose a decision support system (DSS) for selecting and configuring data collection mechanisms. We suggest a generic system model for selecting data collection mechanisms based on the amount of excess data produced. We also provide an implementation of the system. The DSS reduces effort, time, and expertise required in the selection process, and allows both designers and operators to focus on intrusion detection rather than selection and configuration of data collection mechanisms.

intrusion detection

adaptive security

decision support

logging

data collection

Författare

Ulf Larson

Chalmers, Data- och informationsteknik, Datorteknik

Stefan Lindskog

Dennis Nilsson

Chalmers, Data- och informationsteknik, Datorteknik

Erland Jonsson

Chalmers, Data- och informationsteknik, Datorteknik

Proceedings of the 13th Nordic Workshop on Secure IT-systems (NordSec 2008), October 9-10, 2008, Copenhagen, Denmark

Ämneskategorier

Datorteknik