Authors
Rida Khatoun, Dominique Gaïti, Leïla Merghem-Boulahia, Ahmed Serhrouchni,
Title
Optimisation de la detection de Snort par le preprocesseur Global SPADE
In
REE. Revue de l'electricite et de l'electronique.
Volume
9
Issue
79
Pages
88–93
Publisher
Societe de l'Electricite, de l'Electronique et des Technologies de l'Information et de la Communication (SEE)
Year
2008
Publisher's URL
http://cat.inist.fr/?aModele=afficheN&cpsidt=20690613
Indexed by
Abstract
In this paper, we propose a new intrusion detection system (IDS) approach based on the Snort IDS. In fact, current IDS showed unsatisfactory performances in terms of detection. Snort is a prevention and intrusion detection system, which combines the techniques of based-signature detection and based-statistical detection; the latter is the case of the preprocessor SPADE which is based on the probabilities and the Bayesian networks in order to identify scores of abnormal packets in an IP network. SPADE improves the detection yet it increases the number of the false positive alarms. For these reasons, we propose a cooperation approach among the SPADE preprocessors of several IDS, in order to improve the intrusions detection and minimize the number of the false positive alarms. In this article, we present the architecture of our Global SPADE preprocessor. We believe that this approach should optimize the detection capability in a fully distributed and autonomous environment.
Affiliations
Offprint