Sharing information for event analysis over the wide internet

Masahiro Nagao, Kazuhide Koide, Akihiro Satoh, Glenn Mansfield Keeni, Norio Shiratori

    Research output: Contribution to journalArticle

    1 Citation (Scopus)

    Abstract

    Cross-domain event information sharing is a topic of great interest in the area of event based network management. In this work we use data sets which represent actual attacks in the operational Internet. We analyze the data sets to understand the dynamics of the attacks and then go onto show the effectiveness of sharing incident related information to contain these attacks. We describe universal data acquisition system for event based management (UniDAS), a novel system for secure and automated crossdomain event information sharing. The system uses a generic, structured data format based on a standardized incident object description and exchange format (IODEF). IODEF is an XML-based extensible data format for security incident information exchange. We propose a simple and effective security model for IODEF and apply it to the secure and automated generic event information sharing system UniDAS. We present the system we have developed and evaluate its effectiveness.

    Original languageEnglish
    Pages (from-to)382-394
    Number of pages13
    JournalJournal of Communications and Networks
    Volume12
    Issue number4
    Publication statusPublished - 2010 Aug

      Fingerprint

    Keywords

    • Backscatter
    • Darknet
    • Event based network management
    • Event information sharing
    • Incident object description and exchange format (iodef)
    • Network management system
    • Worm propagation

    ASJC Scopus subject areas

    • Computer Networks and Communications
    • Information Systems

    Cite this

    Nagao, M., Koide, K., Satoh, A., Keeni, G. M., & Shiratori, N. (2010). Sharing information for event analysis over the wide internet. Journal of Communications and Networks, 12(4), 382-394.