Toward a Query Language for Network Attack Data

The growing sophistication and diversity of malicious activity in the Internet presents a serious challenge for network security analysts. In this paper, we describe our efforts to develop a database and query language for network attack data from firewalls, intrusion detection systems and honeynets. Our first step toward this objective is to develop a prototype database and query interface to identify coordinated scanning activity in network attack data. We have created a set of aggregate views and templatized SQL queries that consider timing, persistence, targeted services, spatial dispersion and temporal dispersion, thereby enabling us to evaluate coordinated scanning along these dimensions. We demonstrate the utility of the interface by conducting a case study on a set of firewall and intrusion detection system logs from Dshield.org. We show that the interface is able to identify general characteristics of coordinated activity as well as instances of unusual activity that would...

• Type: Conference
• Year: 2006
• Where: ICDE
• Authors: Bee-Chung Chen, Vinod Yegneswaran, Paul Barford, Raghu Ramakrishnan
• Keywords: Database, ICDE 2006, Intrusion Detection System, Network Attack Data, Query Language