A Survay on Alert Visualization Tools in Intrusion Detection Systems

سال انتشار: 1392
محل انتشار: اولین همایش ملی رویکردهای نوین در مهندسی کامپیوتر و بازیابی اطلاعات
کد COI اختصاصی: BPJ01_095
زبان مقاله: انگلیسی
تعداد مشاهده: 1233

نویسندگان

Department of Computer Engineering, Sharif University of Technology, Tehran, Iran,

چکیده

System attacks are growing in Networks. Intrusion detection systems are used to generate security warnings and network traffic analysis. The amounts of log message texts are high and the required time for analysis of them may have negative affect on system. Log messages are text-form and to understand them, managers should read each one separately. Because of this, detecting abnormal behaviour in files is difficult. For this reason it is better to combine log file with visualization techniques. This paper will explain more about alert visualization tools. They have different bandwidth and memory Depending on the type of system tools and applications. However, each has their advantages and disadvantages. Additionally log file problems and different types of intrusion detection system output will be presented. Also various visualization systems are introduced and the requirements for using these tools reviewed. These tools were compared based on the extracted parameters for the evaluation of these systems. And at the end, a novel solution is proposed to facilitate choosing perfect visualization alert system for companies and enterprises.

کلیدواژه ها

Alert, Visualization, Log file, Mapping, Merits, evaluation

مقالات مرتبط جدید

اطلاعات بیشتر در مورد COI

COI مخفف عبارت CIVILICA Object Identifier به معنی شناسه سیویلیکا برای اسناد است. COI کدی است که مطابق محل انتشار، به مقالات کنفرانسها و ژورنالهای داخل کشور به هنگام نمایه سازی بر روی پایگاه استنادی سیویلیکا اختصاص می یابد.

کد COI به مفهوم کد ملی اسناد نمایه شده در سیویلیکا است و کدی یکتا و ثابت است و به همین دلیل همواره قابلیت استناد و پیگیری دارد.