본문 바로가기
  • Home

Efficient Attack Traffic Detection Method for Reducing False Alarms

  • Journal of The Korea Society of Computer and Information
  • Abbr : JKSCI
  • 2009, 14(5), pp.65-75
  • Publisher : The Korean Society Of Computer And Information
  • Research Area : Engineering > Computer Science

최일준 1 추병균 1 Changsuk Oh 1

1충북대학교

Accredited

ABSTRACT

The development of IT technology, Internet popularity is increasing geometrically. However, as its side effect, the intrusion behaviors such as information leakage for key system and infringement of computation network etc are also increasing fast. The attack traffic detection method which is suggested in this study utilizes the Snort, traditional NIDS, filters the packet with false positive among the detected attack traffics using Nmap information. Then, it performs the secondary filtering using nessus vulnerability information and finally performs correlation analysis considering appropriateness of management system, severity of signature and security hole so that it could reduce false positive alarm message as well as minimize the errors from false positive and as a result, it raised the overall attack detection results.

Citation status

* References for papers published after 2023 are currently being built.