Intrusion detection using ASTDs - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

Intrusion detection using ASTDs

Résumé

In this paper, we show the application of ASTDs to intrusion detection. ASTD is an executable, modular and graphical notation that allows for the composition of hierarchical state machines with process algebra operators to model complex attack phases. Overall, ASTD attack specifications are more concise than industrial tools like Snort, Zeek, and other attack languages in the literature. For intrusion detection, iASTD (the ASTD interpreter) and Zeek provided similar results. iASTD produced less false positives and a smaller number of true positives per attack than Snort, which is an important factor to deal with huge amounts of events. The processing time of iASTD on the real-time testbed is slower than Snort and Zeek, but it can be improved by compiling ASTD specifications into Zeek scripts.
Fichier non déposé

Dates et versions

hal-02975779 , version 1 (22-10-2020)

Identifiants

Citer

Lionel Nganyewou Tidjon, Marc Frappier, Amel Mammar. Intrusion detection using ASTDs. AINA 2020: 34th international conference on Advanced Information Networking and Applications, Apr 2020, Caserta, Italy. pp.1397-1411, ⟨10.1007/978-3-030-44041-1_118⟩. ⟨hal-02975779⟩
50 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More