Flow data analysis: a collaborative model to detect attacks against networks using a hybrid architecture

• Grant number: 12/10149-9
• Support Opportunities: Scholarships in Brazil - Scientific Initiation
• Start date: August 01, 2012
• End date: July 31, 2013
• Field of knowledge: Physical Sciences and Mathematics - Computer Science - Computer Systems
• Principal Investigator: Adriano Mauro Cansian
• Grantee: Raphael Campos Silva
• Host Institution: Instituto de Biociências, Letras e Ciências Exatas (IBILCE). Universidade Estadual Paulista (UNESP). Campus de São José do Rio Preto. São José do Rio Preto , SP, Brazil

Abstract

This project, in the information security field, aims to research methods to integrate a variety of existent and non-existent detection techniques using them all together to improve the network traffic analyses. The ongoing advance of research on intrusion detection leads to the development of new methodologies, which are not normally used collaboratively. Cooperative use of the methodologies mentioned above would promote a more accurate result in the detection of attacks. However, this procedure might generate an excessive number of alerts, which turns the network environment more difficult to monitor. In order to mitigate this difficulty, this project proposes a methodology capable of correlating the alerts originating from several intrusions detection systems. Alerts from the same attack taxonomy will be grouped so that the alert analysis by the network administrator will be facilitated. Moreover, a module of attack detection based on data flow is proposed, this module will use the enlace layer information for analysis. As a result of this approach, we intend to build a system that 1) facilities the network administrator's analysis of alerts originated from several intrusion detection methods in a collaborative architecture; and 2) possibly decreases the amount of traffic exchanged between the correlation units.(AU)