WG: Requirements for Network Monitoring from anIDS Perspective

Network Attack Detection and Defense

计算机科学;物理学

Lothar Braun ; Falko Dressler ; Thorsten Holz ; Engin Kirda ; Jan Kohlrausch ; Christopher Kruegel

Others  :  http://drops.dagstuhl.de/opus/volltexte/2008/1497/pdf/08102.SWM.Paper.1497.pdf
PID  :  50373

学科分类：计算机科学（综合）

来源: CEUR

【 摘 要 】

Detection of malicious traffic is based on its input data, the information that is coming from network-based monitoring systems. Best detection rates would only be possible by monitoring all data transferred over all network lines in a distributed network. Monitoring and reporting this amount of data are feasible in neither today's, nor will be in future's systems. Later analysis like stateful inspection of the traffic imposes even more processing costs. But only at this level of monitoring and analysis there may be a chance to capture all attacks inside a system. So there needs to be a trade-off between detection success and the processing costs.[First Paragraph]