Optimisation de la détection de Snort par le préprocesseur Global SPADE - Archive ouverte HAL Access content directly
Journal Articles La Revue de l'électricité et de l'électronique Year : 2008

Optimisation de la détection de Snort par le préprocesseur Global SPADE

Rida Khatoun
Dominique Gaïti
  • Function : Author
  • PersonId : 868504
Ahmed Serhrouchni
  • Function : Author
  • PersonId : 1105660

Abstract

In this paper, we propose a new intrusion detection system (IDS) approach based on the Snort IDS. In fact, current IDS showed unsatisfactory performances in terms of detection. Snort is a prevention and intrusion detection system, which combines the techniques of based-signature detection and based-statistical detection; the latter is the case of the preprocessor SPADE which is based on the probabilities and the Bayesian networks in order to identify scores of abnormal packets in an IP network. SPADE improves the detection yet it increases the number of the false positive alarms. For these reasons, we propose a cooperation approach among the SPADE preprocessors of several IDS, in order to improve the intrusions detection and minimize the number of the false positive alarms. In this article, we present the architecture of our Global SPADE preprocessor. We believe that this approach should optimize the detection capability in a fully distributed and autonomous environment.
Not file

Dates and versions

hal-02618734 , version 1 (25-05-2020)

Identifiers

  • HAL Id : hal-02618734 , version 1

Cite

Rida Khatoun, Dominique Gaïti, Leila Merghem-Boulahia, Ahmed Serhrouchni. Optimisation de la détection de Snort par le préprocesseur Global SPADE. La Revue de l'électricité et de l'électronique, 2008, 9 (79), pp.88-93. ⟨hal-02618734⟩
43 View
0 Download

Share

Gmail Facebook Twitter LinkedIn More