Title

Locality-Based Server Profiling For Intrusion Detection

Keywords

Computer network security; Intrusion detection; Local area networks; Network servers

Abstract

Detection of intrusion on network servers plays an ever more important role in network security. This paper investigates whether analysis of incoming connection behavior for properties of locality can be used to create a normal profile for network servers. Intrusions can then be detected due to their abnormal behavior. Experiments show that connections to a typical network server do in fact exhibit locality, and attacks can be detected through their violation of locality. © 2008 Springer-Verlag Berlin Heidelberg.

Publication Date

7-1-2008

Publication Title

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volume

5075 LNCS

Number of Pages

205-216

Document Type

Article; Proceedings Paper

Personal Identifier

scopus

DOI Link

https://doi.org/10.1007/978-3-540-69304-8_21

Socpus ID

45849131310 (Scopus)

Source API URL

https://api.elsevier.com/content/abstract/scopus_id/45849131310

This document is currently not available here.

Share

COinS