Collaborative Anomaly-Based Attack Detection

@incollection{citeulike:1949931, abstract = {Today networks suffer from various challenges like distributed denial of service attacks or worms. Multiple different anomaly-based detection systems try to detect and counter such challenges. Anomaly-based systems, however, often show high false negative rates. One reason for this is that detection systems work as single instances that base their decisions on local knowledge only. In this paper we propose a collaboration of neighboring detection systems that enables receiving systems to search specifically for that attack which might have been missed by using local knowledge only. Once such attack information is received a decision process has to determine if a search for this attack should be started. The design of our system is based on several principles which guide this decision process. Finally, the attack information will be forwarded to the next neighbors increasing the area of collaborating systems.}, author = {Gamer, Thomas and Scharf, Michael and Sch\"{o}ller, Marcus }, citeulike-article-id = {1949931}, doi = {10.1007/978-3-540-74917-2\_23}, journal = {Self-Organizing Systems}, keywords = {anomaly, attack-detection, networks}, month = {August}, pages = {280--287}, posted-at = {2007-11-21 10:48:39}, priority = {3}, title = {Collaborative Anomaly-Based Attack Detection}, url = {http://dx.doi.org/10.1007/978-3-540-74917-2\_23}, volume = {4725/2007}, year = {2007} }

TY - CHAP ID - citeulike:1949931 L3 - citeulike-article-id:1949931 TI - Collaborative Anomaly-Based Attack Detection JF - Self-Organizing Systems VL - 4725/2007 SP - 280 EP - 287 N2 - Today networks suffer from various challenges like distributed denial of service attacks or worms. Multiple different anomaly-based detection systems try to detect and counter such challenges. Anomaly-based systems, however, often show high false negative rates. One reason for this is that detection systems work as single instances that base their decisions on local knowledge only. In this paper we propose a collaboration of neighboring detection systems that enables receiving systems to search specifically for that attack which might have been missed by using local knowledge only. Once such attack information is received a decision process has to determine if a search for this attack should be started. The design of our system is based on several principles which guide this decision process. Finally, the attack information will be forwarded to the next neighbors increasing the area of collaborating systems. KW - anomaly KW - attack-detection KW - networks AU - Gamer, Thomas AU - Scharf, Michael AU - Schöller, Marcus PY - 2007/08/26/ UR - http://dx.doi.org/10.1007/978-3-540-74917-2_23 ER -