Correlação e visualização de alertas de segurança em redes de computadores

• Ano de defesa: 2015
• Autor(a) principal: Ribeiro, Adriano Cesar [UNESP]
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Estadual Paulista (Unesp)
• Palavras-chave em Português: Computação; Redes de computadores - Medidas de segurança; Sistemas de detecção de intrusão (Medidas de segurança); Visualização da informação; Mineração de dados (Computação)
• Link de acesso: http://hdl.handle.net/11449/127861

Intrusion detection systems provides valuable information regarding the security of computer networks. However, due to the amount of threats inherent in computer systems, records of these threats in the form of alerts can be large volumes of data, often quite complex to be analyzed in a timely manner. This paper presents an approach to correlate security alerts. The methodology is based on the use of data mining to the collection of constituent information in the alerts provided by intrusion detection systems. First, alerts are classified into types of attacks so that, later, are clustered in order to compose alerts with similar characteristics. Finally, the correlation is performed based on the occurrence of alerts in each cluster and thereby an overview of the attack scenario is obtained using visualization methods of such malicious events.