Incident Reaction Based on Intrusion Detections’ Alert Analysis

Incident Reaction Based on Intrusion Detections’ Alert Analysis

The protection of internetworked systems by cryptographic techniques have crystallized as a fundamental aspect in establishing secure systems. Complementary, detection mechanisms for instance based on Intrusion Detection Systems has established itself as a fundamental part in holistic security eco-systems in the previous years. However, the interpretation of and reaction on detected incidents is still a challenging task. In this paper an incident handling environment with relevant components and exemplary functionality is proposed that involves the processes from the detection of incidents over their analysis to the execution of appropriate reactions. An evaluation of a selection of implemented interacting components using technology such as OpenFlow or Snort generally proofs the concept.

This is a preprint version of the article.

Keywords: network security; intrusion detection; alert analysis

Year: 2018

Download: download Full text [508 kB]
View record in Web of Science®

Authors of this publication:

Michael Heigl


Michael is currently working as a research associate at the institute ProtectIT at the Deggendorf Institute of Technology and holds a Ph.D. degree from the University of West Bohemia for his dissertation on machine learning enhanced network-based anomaly detection. He is specialized in improving outlier detection methods for streaming data applications.

Dalibor Fiala

Phone: +420 377 63 2429

Dalibor is the research group coordinator and an associate professor at the Department of Computer Science and Engineering at the University of West Bohemia in Pilsen, Czech Republic. He is interested in data mining, web mining, information retrieval, informetrics, and information science.

Related Projects:


Data Mining for Computer Networks Security

Authors:  Michael Heigl, Laurin Doerr, Dalibor Fiala
Desc.:Novel data mining methods for the enhancement of computer networks security using advanced outlier detection techniques on streaming data are investigated.