A Global Security Architecture for Intrusion Detection on Computer Networks

Abdoul-Karim Ganame (1) , Julien Bourgeois (1) , Renaud Bidou (1) , Franã§ois Spies (1)

1 FEMTO-ST - Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies (UMR 6174)

Detecting all kinds of intrusions efficiently requires a global view of the monitored network. Built to increase the security of computer networks, traditional IDS are unfortunately unable to give a global view of the security of a network. To overcome this situation, we are developing a distributed SOC (Security Operation Center) which is able to detect attacks occurring simultaneously on several sites in a network and to give a global view of the security of that network. In this article, we present the global architecture of our system, called DSOC as well as several methods used to test its accuracy and performance.

Domaines: Informatique mobile; Réseaux et télécommunications [cs.NI]; Modélisation et simulation

Abdoul-Karim Ganame, Julien Bourgeois, Renaud Bidou, Franã§ois Spies. A Global Security Architecture for Intrusion Detection on Computer Networks. Computers & Security, 2008, pp.30--47. ⟨hal-00663122⟩