Comparing Intrusion Detection Tools using Generic Vulnerability Categories
نویسنده
چکیده
Any organisation connected to the Internet that is serious about security cannot be without an intrusion detection system (IDS) these days. Is one IDS sufficient to cover all possible vulnerabilities in a network? In a sea of security products available today, which IDS tool(s) will be sufficient for your organisation’s needs? The only way to find out is to compare various IDS tools with each other. But how? Each IDS tool has a vulnerability database containing hundreds of known vulnerabilities it scans for to resolve the vulnerabilities it has found. Not one IDS tool contains the same number of vulnerabilities it scans for. In addition, many vulnerabilities that are present in the vulnerability database of a specific IDS are also present in the vulnerability databases of other IDS tools. In other words, many IDS tools scan for the same vulnerabilities. On the other hand, certain IDS tools scan for unique vulnerabilities. This paper suggests the method of using generic vulnerability categories, which may act as a standard in comparing IDS tools. 2 H.S. VENTER ([email protected]) J.H.P. ELOFF ([email protected])
منابع مشابه
A Review of Intrusion Detection Defense Solutions Based on Software Defined Network
Most networks without fixed infrastructure are based on cloud computing face various challenges. In recent years, different methods have been used to distribute software defined network to address these challenges. This technology, while having many capabilities, faces some vulnerabilities in the face of some common threats and destructive factors such as distributed Denial of Service. A review...
متن کاملAdvanced Vulnerability Analysis and Intrusion Detection Through Predictive Attack Graphs
Current network security tools generally lack sufficient context for maintaining a well informed and proactive defense posture. Vulnerabilities are usually assessed in isolation, without considering how they contribute to overall attack risk. Similarly, intrusion alarms are logged as isolated events, with limited correlation capabilities. Security professionals are overwhelmed by constant threa...
متن کاملReasoning about Complementary Intrusion Evidence
This paper presents techniques to integrate and reason about complementary intrusion evidence such as intrusion alerts generated by intrusion detection systems (IDSs) and reports by system monitoring or vulnerability scanning tools. To facilitate the modeling of intrusion evidence, this paper classifies intrusion evidence into either event-based evidence or state-based evidence. Event-based evi...
متن کاملA New Approach to the Specification of General Computer Security Policies
The notion of Computer Policy is fundamental to the study of computer security models, the analysis of computer vulnerabilities, the development of intrusion detection tools, and the development of misuse detection tools. Security only makes sense in relation to security policies that specify what is being protected, how it must be protected, who has access to what is being protected, etc. Poli...
متن کاملAssessment of Saltwater Pollution in Azarshahr Plain Groundwater, Iran: Conjugating GALDIT Method and Geostatistics
Overutilization of groundwater resources can put their quality under stress. It could be base on rapid declination in groundwater level leading to salt water intrusion in the coastal aquifers. The objective of this study was to map the vulnerability of salt water intrusion of the Urmia Lake, Iran to nearby coastal aquifer (Azarshahr) using GALDIT method. The GALDIT index based on six parameters...
متن کامل