TY - GEN
T1 - Intrusion Detection Using ASTDs
AU - Tidjon, Lionel N.
AU - Frappier, Marc
AU - Mammar, Amel
N1 - Publisher Copyright:
© 2020, Springer Nature Switzerland AG.
PY - 2020/1/1
Y1 - 2020/1/1
N2 - In this paper, we show the application of ASTDs to intrusion detection. ASTD is an executable, modular and graphical notation that allows for the composition of hierarchical state machines with process algebra operators to model complex attack phases. Overall, ASTD attack specifications are more concise than industrial tools like Snort, Zeek, and other attack languages in the literature. For intrusion detection, iASTD (the ASTD interpreter) and Zeek provided similar results. iASTD produced less false positives and a smaller number of true positives per attack than Snort, which is an important factor to deal with huge amounts of events. The processing time of iASTD on the real-time testbed is slower than Snort and Zeek, but it can be improved by compiling ASTD specifications into Zeek scripts.
AB - In this paper, we show the application of ASTDs to intrusion detection. ASTD is an executable, modular and graphical notation that allows for the composition of hierarchical state machines with process algebra operators to model complex attack phases. Overall, ASTD attack specifications are more concise than industrial tools like Snort, Zeek, and other attack languages in the literature. For intrusion detection, iASTD (the ASTD interpreter) and Zeek provided similar results. iASTD produced less false positives and a smaller number of true positives per attack than Snort, which is an important factor to deal with huge amounts of events. The processing time of iASTD on the real-time testbed is slower than Snort and Zeek, but it can be improved by compiling ASTD specifications into Zeek scripts.
U2 - 10.1007/978-3-030-44041-1_118
DO - 10.1007/978-3-030-44041-1_118
M3 - Conference contribution
AN - SCOPUS:85083697376
SN - 9783030440404
T3 - Advances in Intelligent Systems and Computing
SP - 1397
EP - 1411
BT - Advanced Information Networking and Applications - Proceedings of the 34th International Conference on Advanced Information Networking and Applications, AINA 2020
A2 - Barolli, Leonard
A2 - Amato, Flora
A2 - Moscato, Francesco
A2 - Enokido, Tomoya
A2 - Takizawa, Makoto
PB - Springer
T2 - 34th International Conference on Advanced Information Networking and Applications, AINA 2020
Y2 - 15 April 2020 through 17 April 2020
ER -