Bro: a System for Detecting Network Intruders in Real-time

@article{Bro, abstract = {We describe Bro, a stand-alone system for detecting network intruders in real-time by passively monitoring a network link over which the intruder's traffic transits. We give an overview of the system's design, which emphasizes highspeed (FDDI-rate) monitoring, real-time notification, clear separation between mechanism and policy, and extensibility. To achieve these ends, Bro is divided into an "event engine" that reduces a kernel-filtered network traffic stream into a series of higher-level...}, author = {Paxson, Vern }, booktitle = {Computer Networks}, citeulike-article-id = {366723}, journal = {Computer Networks (Amsterdam, Netherlands: 1999)}, keywords = {hma, intrusion\_detection}, number = {23--24}, pages = {2435--2463}, posted-at = {2005-10-27 13:59:01}, priority = {3}, title = {Bro: a System for Detecting Network Intruders in Real-time}, url = {http://citeseer.ist.psu.edu/paxson98bro.html}, volume = {31}, year = {1999} }

TY - JOUR ID - Bro L3 - citeulike-article-id:366723 N2 - We describe Bro, a stand-alone system for detecting network intruders in real-time by passively monitoring a network link over which the intruder's traffic transits. We give an overview of the system's design, which emphasizes highspeed (FDDI-rate) monitoring, real-time notification, clear separation between mechanism and policy, and extensibility. To achieve these ends, Bro is divided into an "event engine" that reduces a kernel-filtered network traffic stream into a series of higher-level... IS - 23--24 JF - Computer Networks (Amsterdam, Netherlands: 1999) EP - 2463 TI - Bro: a System for Detecting Network Intruders in Real-time VL - 31 T2 - Computer Networks SP - 2435 KW - hma KW - intrusion_detection AU - Paxson, Vern PY - 1999/// UR - http://citeseer.ist.psu.edu/paxson98bro.html ER -