• 主题
高级搜索  >
历史搜索 清空历史
首页> 美国政府科技报告 >Developing Collaborative Profiles of Attackers: A Longitudinal Study; Final progress rept. 1 Oct 2004-30 Sep 2006
【24h】

Developing Collaborative Profiles of Attackers: A Longitudinal Study; Final progress rept. 1 Oct 2004-30 Sep 2006

机译：制定攻击者协作档案：纵向研究;最后的进展情况。 2004年10月1日至2006年9月30日

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

We implemented a new content anomaly detector, Anagram, which models a mixture of high-order n-grams (n > 1) designed to detect anomalous and 'suspicious' network packet payloads. For both Anagram and previously developed anomaly detector, Payl, we explored possible ways in which payload-based correlation can be applied, so that the alerts generated by both sensors can be included in our 'collaborative security' infrastructure, called Worminator. Worminator is designed to exchange information securely, privately and in real- time between sites in order to reveal an accurate view of external threats, especially stealthy ones. To address the need for efficient alert correlation, we introduced the notion of network scheduling: the controllable formation and dissolution of relationships between nodes and groups of nodes in a network. Our network scheduling mechanism is a procedure for coordinating the exchange of information between the members of a correlation group. The mechanism is controlled by a dynamic and parameterizable correlation schedule. We performed a longitudinal study which is designed to demonstrate the proposed Worminator hypothesis, that collaborative intrusion detection not only enables detection of worm spread but also scanning behavior as precursors to an attack. There are three key longitudes for analysis: over time, over geographical and network space and by target.

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号