Detailed Information on Publication Record

@inproceedings{25546,
   author = {Husák, Martin and Čermák, Milan and Laštovička, Martin and Vykopal, Jan},
   address = {Lisbon},
   booktitle = {2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)},
   keywords = {aggregation;security alert;information sharing},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Lisbon},
   isbn = {978-3-901882-89-0},
   pages = {604-607},
   publisher = {IEEE},
   title = {Exchanging Security Events: Which And How Many Alerts Can We Aggregate?},
   url = {http://ieeexplore.ieee.org/document/7987340/},
   year = {2017}
}

TY  - JOUR
ID  - 25546
AU  - Husák, Martin - Čermák, Milan - Laštovička, Martin - Vykopal, Jan
PY  - 2017
TI  - Exchanging Security Events: Which And How Many Alerts Can We Aggregate?
PB  - IEEE
CY  - Lisbon
SN  - 9783901882890
KW  - aggregation;security alert;information sharing
UR  - http://ieeexplore.ieee.org/document/7987340/
N2  - The exchange of security alerts is a current trend in network security and incident response. Alerts from network intrusion detection systems are shared among organizations so that it is possible to see the ''big picture'' of current security situation. However, the quality and redundancy of the input data seem to be underrated. We present four use cases of aggregation of the alerts from network intrusion detection systems. Alerts from a sharing platform deployed in the Czech national research and education network were examined in a case study. Volumes of raw and aggregated data are presented and a rule of thumb is proposed: up to 85 % of alerts can be aggregated. Finally, we discuss the practical implications of alert aggregation for the network intrusion detection system, such as (in)completeness of the alerts and optimal time windows for aggregation.
ER  - 

HUSÁK, Martin, Milan ČERMÁK, Martin LAŠTOVIČKA and Jan VYKOPAL. Exchanging Security Events: Which And How Many Alerts Can We Aggregate?. Online. In \textit{2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)}. Lisbon: IEEE, 2017, p.~604-607. ISBN~978-3-901882-89-0.