A serial combination of anomaly and misuse IDSes applied to HTTP traffic

Elvis Tombini; Hervé Debar; Ludovic Mé; Mireille Ducassé

doi:10.1109/CSAC.2004.4

A serial combination of anomaly and misuse IDSes applied to HTTP traffic

Elvis Tombini
, Hervé Debar
, Ludovic Mé
, Mireille Ducassé

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Combining an "anomaly" and a "misuse" IDSes offers the advantage of separating the monitored events between normal, intrusive or unqualified classes (ie not known as an attack, but not recognize as safe either). In this article, we provide a framework to systematically reason about the combination of anomaly and misuse components. This framework applied to web servers lead us to propose a serial architecture, using a drastic anomaly component with a sensitive misuse component. This architecture provides the operator with better qualification of the detection results, raises lower amount of false alarms and unqualified events.

Original language	English
Title of host publication	Proceedings - 20th Annual Computer Security Applications Conference, ACSAC 2004
Pages	428-437
Number of pages	10
DOIs	https://doi.org/10.1109/CSAC.2004.4
Publication status	Published - 1 Dec 2004
Externally published	Yes
Event	20th Annual Computer Security Applications Conference, ACSAC 2004 - Tucson, AZ, United States Duration: 6 Dec 2004 → 10 Dec 2004

Publication series

Name	Proceedings - Annual Computer Security Applications Conference, ACSAC
ISSN (Print)	1063-9527

Conference

Conference	20th Annual Computer Security Applications Conference, ACSAC 2004
Country/Territory	United States
City	Tucson, AZ
Period	6/12/04 → 10/12/04

Access to Document

10.1109/CSAC.2004.4

Cite this

@inproceedings{e7dda792e09d4e06902fb1f836e68d3f,

title = "A serial combination of anomaly and misuse IDSes applied to HTTP traffic",

abstract = "Combining an {"}anomaly{"} and a {"}misuse{"} IDSes offers the advantage of separating the monitored events between normal, intrusive or unqualified classes (ie not known as an attack, but not recognize as safe either). In this article, we provide a framework to systematically reason about the combination of anomaly and misuse components. This framework applied to web servers lead us to propose a serial architecture, using a drastic anomaly component with a sensitive misuse component. This architecture provides the operator with better qualification of the detection results, raises lower amount of false alarms and unqualified events.",

author = "Elvis Tombini and Herv{\'e} Debar and Ludovic M{\'e} and Mireille Ducass{\'e}",

year = "2004",

month = dec,

day = "1",

doi = "10.1109/CSAC.2004.4",

language = "English",

isbn = "0769522521",

series = "Proceedings - Annual Computer Security Applications Conference, ACSAC",

pages = "428--437",

booktitle = "Proceedings - 20th Annual Computer Security Applications Conference, ACSAC 2004",

note = "20th Annual Computer Security Applications Conference, ACSAC 2004 ; Conference date: 06-12-2004 Through 10-12-2004",

}

Tombini, E, Debar, H, Mé, L & Ducassé, M 2004, A serial combination of anomaly and misuse IDSes applied to HTTP traffic. in Proceedings - 20th Annual Computer Security Applications Conference, ACSAC 2004. Proceedings - Annual Computer Security Applications Conference, ACSAC, pp. 428-437, 20th Annual Computer Security Applications Conference, ACSAC 2004, Tucson, AZ, United States, 6/12/04. https://doi.org/10.1109/CSAC.2004.4

A serial combination of anomaly and misuse IDSes applied to HTTP traffic. / Tombini, Elvis; Debar, Hervé; Mé, Ludovic et al.
Proceedings - 20th Annual Computer Security Applications Conference, ACSAC 2004. 2004. p. 428-437 (Proceedings - Annual Computer Security Applications Conference, ACSAC).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A serial combination of anomaly and misuse IDSes applied to HTTP traffic

AU - Tombini, Elvis

AU - Debar, Hervé

AU - Mé, Ludovic

AU - Ducassé, Mireille

PY - 2004/12/1

Y1 - 2004/12/1

N2 - Combining an "anomaly" and a "misuse" IDSes offers the advantage of separating the monitored events between normal, intrusive or unqualified classes (ie not known as an attack, but not recognize as safe either). In this article, we provide a framework to systematically reason about the combination of anomaly and misuse components. This framework applied to web servers lead us to propose a serial architecture, using a drastic anomaly component with a sensitive misuse component. This architecture provides the operator with better qualification of the detection results, raises lower amount of false alarms and unqualified events.

AB - Combining an "anomaly" and a "misuse" IDSes offers the advantage of separating the monitored events between normal, intrusive or unqualified classes (ie not known as an attack, but not recognize as safe either). In this article, we provide a framework to systematically reason about the combination of anomaly and misuse components. This framework applied to web servers lead us to propose a serial architecture, using a drastic anomaly component with a sensitive misuse component. This architecture provides the operator with better qualification of the detection results, raises lower amount of false alarms and unqualified events.

UR - https://www.scopus.com/pages/publications/21644481499

U2 - 10.1109/CSAC.2004.4

DO - 10.1109/CSAC.2004.4

M3 - Conference contribution

AN - SCOPUS:21644481499

SN - 0769522521

T3 - Proceedings - Annual Computer Security Applications Conference, ACSAC

SP - 428

EP - 437

BT - Proceedings - 20th Annual Computer Security Applications Conference, ACSAC 2004

T2 - 20th Annual Computer Security Applications Conference, ACSAC 2004

Y2 - 6 December 2004 through 10 December 2004

ER -

A serial combination of anomaly and misuse IDSes applied to HTTP traffic

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this