Automating Human Workflow in IDS Analysis

This title is printed to order. This book may have been self-published. If so, we cannot guarantee the quality of the content. In the main most books will have gone through the editing process however some may not. We therefore suggest that you be aware of this before ordering this book. If in doubt check either the author or publisher’s details as we are unable to accept any returns unless they are faulty. Please contact us if you have any questions.

Revision with unchanged content. Nowadays Intrusion Detection Systems (IDS) are still relying on human analysts, fulfilling the task of attack detection. The alarm overload produced by said systems requires a relief of the analyst’s daily workload. After an introduction to network security, the book presents an approach based on finite state machines (FSM), showing that human analysis behavior can be modeled directly from IDS log data. The specific alarm data alone revealed lacking information needed for the chosen Text Classification approach to create an operational decision model for the FSM. Further research is necessary. Rationales and suggestions to solve the problems are discussed. This work was written as Diploma Thesis at the Department of Informatics, University of Zurich in collaboration with Swisscom Innovations Inc, Bern, where this is also a spearhead of ongoing and future research in the area of traffic to protocol state machine reverse engineering.