Distributed intrusion detection: Theory, engineering and application

الموضوعات

علوم تطبيقية وتكنولوجية

الملخص

The proliferation of heterogeneous computer networks adds a large complexity to the intrusion detection problem. In particular, the increased connectivity of computer systems gives greater access to outsiders and makes it easier for intruders to bypass detection; especially, when attacks are spread through the network. In such case, the attacker can launch a distributed attack. The main problem of our research is to enhance the performance of traditional Intrusion Detection Systems (IDSs) in order to detect distributed attacks. To reduce the drawbacks of existing techniques; we develop in this thesis work several solutions and mechanisms. Our first approach proposes a general correlation environment using a novel concept called Multi-violation Detectors (MvD). The MvD-based correlation function manipulates modified structures of events based on metrics that evaluate them. The used correlation functions are managed using a neural-like network architecture that deploys two categories of learning algorithms: a supervised algorithm using back propagation learning to detect known attacks and a non-supervised algorithm using Self-Organizing Map to detect unknown attacks. The second approach develops IDSs for the wireless environment. To this end, three issues have been addressed: (1) providing a useful tool, that is capable of analyzing radio-based attacks on the radio interface; (2) developing a cooperative environment based on the signal analysis; and (3) developing a wavelet-based correlation to help distributed detection. The third approach proposes a global intrusion detection and tolerance system that allows the detection of a set of complex attacks, at their early stages. It integrates the analysis of storage requests (such as read/write) in order to detect whether they are legitimate or malicious. In order to be able to detect distributed attacks, a global cooperation scheme involves the remaining sites, occurring in the detected attack. Additionally, we set up an intrusion tolerance process that allows the collection of an ad hoc set of evidences that may help to detect the Distributed-Reflector Denial of Service attacks

روابط وملفات

التعريف والنوع

رقم الوثيقة

098b5d9c-728b-4c03-b26f-dd148997e038

رقم العقد

0

نوع الوسائط

Crawler

نوع المحتوى

الرسائل العلمية

صيغة المصدر

رسائل دكتوراة

نوع الملف

pdf text

أسماء الملفات

098b5d9c-728b-4c03-b26f-dd148997e038_1.pdf

بيانات النشر

ألقاب المؤلفين

[{"name_ar":"Amel Meddeb-Makhlouf","title_ar":"اعداد","title_en":"Preparation"},{"name_ar":"Noureddine Boudriga ","title_ar":"اشراف","title_en":"Supervision"}]

اللغة

English

المصدر والدورية

اسم المصدر

 Distributed intrusion detection: Theory, engineering and application

المحتوى والصفحات

عدد الصفحات

0

كلمات الباحثين

Distributed intrusion detection, attack scenarios, correlation, wireless intrusion detection, Multi-violation Detectors, Neural-like network, learning, global intrusion detection and tolerance, cooperation.

إشراف وإعداد

الإشراف

Noureddine Boudriga

الإعداد

Amel Meddeb-Makhlouf

الاقتباسات الببليوغرافية