BROWSE
Detail
Conference Paper
Intrusion Alert Normalization Method using AWK Scripts and Attack Name Database
Cited - time in 
Share 
Share
- Authors
- Dong Young Kim, Hyo Chan Bang, Jung Chan Na
- Issue Date
- 2005-02
- Citation
- International Conference on Advanced Communication Technology (ICACT) 2005, pp.608-611
- Publisher
- IEEE
- Language
- English
- Type
- Conference Paper
- Abstract
- The current several classes of intrusion alert have various formats and semantics. And it is transferred using a variety of protocols. The protocols that transfer intrusion alert are IDXP, SNMP trap, SYSLOG protocol, etc. These varieties of intrusion alert formats make it difficult to use that together. Intrusion alert normalization makes various intrusions alert to same structure data and same semantics. We need this normalization process to unify alerts from a variety of security equipments. This paper describes how to normalize alerts from several IDS and security equipments.
- KSP Keywords
- Normalization method, SNMP TRAP, Same structure