A Cloud Immune Security Model Based on Alert Correlation and Software Defined Network

R. Melo, D. D. J. D. Macedo
{"title":"A Cloud Immune Security Model Based on Alert Correlation and Software Defined Network","authors":"R. Melo, D. D. J. D. Macedo","doi":"10.1109/WETICE.2019.00019","DOIUrl":null,"url":null,"abstract":"In this paper, we explore the AIS approach to develop an agent-based detection method to analyze network traffic. The system works in conjunction with attack graph based correlation and software-defined network (SDN) technology to mitigate attacks. In the correlation technique, alerts are correlated through an attack graph which improves detection performance by decreasing the false alert rate. The false alert reduction can avoid the negative effect that an SDN countermeasure can bring to the cloud Service Level Agreement (SLA) on the absence of threats. This work was tested for multi-step and distributed denial of service (DDoS) attacks. Results have shown the addition of the correlation technique can aid to the detection performance of AIS detection systems.","PeriodicalId":116875,"journal":{"name":"2019 IEEE 28th International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"4","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2019 IEEE 28th International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/WETICE.2019.00019","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 4

Abstract

In this paper, we explore the AIS approach to develop an agent-based detection method to analyze network traffic. The system works in conjunction with attack graph based correlation and software-defined network (SDN) technology to mitigate attacks. In the correlation technique, alerts are correlated through an attack graph which improves detection performance by decreasing the false alert rate. The false alert reduction can avoid the negative effect that an SDN countermeasure can bring to the cloud Service Level Agreement (SLA) on the absence of threats. This work was tested for multi-step and distributed denial of service (DDoS) attacks. Results have shown the addition of the correlation technique can aid to the detection performance of AIS detection systems.
查看原文
分享 分享
微信好友 朋友圈 QQ好友 复制链接
本刊更多论文
基于警报关联和软件定义网络的云免疫安全模型
在本文中,我们探索AIS的方法来开发一个基于代理的检测方法来分析网络流量。该系统结合基于攻击图的关联和软件定义网络(SDN)技术来减轻攻击。在关联技术中,警报通过攻击图进行关联,通过降低假警报率来提高检测性能。减少虚假警报可以避免SDN对策对云服务水平协议SLA (Service Level Agreement)无威胁带来的负面影响。这项工作针对多步骤和分布式拒绝服务(DDoS)攻击进行了测试。结果表明,相关技术的加入有助于提高AIS检测系统的检测性能。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 去求助
来源期刊
自引率
0.00%
发文量
0
期刊最新文献
Real-Time SCADA Attack Detection by Means of Formal Methods Architecture of Anomaly Detection Module for the Security Operations Center Privacy Preserving Intrusion Detection Via Homomorphic Encryption A Deep Learning Framework to Predict Rating for Cold Start Item Using Item Metadata Mining Developer's Behavior from Web-Based IDE Logs
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
已复制链接
已复制链接
快去分享给好友吧!
我知道了
×
扫码分享
扫码分享
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1