Sciweavers

Share
ICDE
2006
IEEE

Toward a Query Language for Network Attack Data

11 years 5 months ago
Toward a Query Language for Network Attack Data
The growing sophistication and diversity of malicious activity in the Internet presents a serious challenge for network security analysts. In this paper, we describe our efforts to develop a database and query language for network attack data from firewalls, intrusion detection systems and honeynets. Our first step toward this objective is to develop a prototype database and query interface to identify coordinated scanning activity in network attack data. We have created a set of aggregate views and templatized SQL queries that consider timing, persistence, targeted services, spatial dispersion and temporal dispersion, thereby enabling us to evaluate coordinated scanning along these dimensions. We demonstrate the utility of the interface by conducting a case study on a set of firewall and intrusion detection system logs from Dshield.org. We show that the interface is able to identify general characteristics of coordinated activity as well as instances of unusual activity that would...
Bee-Chung Chen, Vinod Yegneswaran, Paul Barford, R
Added 11 Jun 2010
Updated 11 Jun 2010
Type Conference
Year 2006
Where ICDE
Authors Bee-Chung Chen, Vinod Yegneswaran, Paul Barford, Raghu Ramakrishnan
Comments (0)
books