A Scalable Aural-Visual Environment for Security Event Monitoring, Analysis, and Response

Abstract. Intrusion detection systems gather large quantities of host and network information in an attempt to detect and respond to attacks against an organization. The widely varying nature of attacks makes humans essential for analysis, but the sheer volume of data can quickly overwhelm even experienced analysts. Existing approaches utilize visualization to provide rapidly comprehensible representations of the data, but fail to scale to real-world environments due to unrealistic data handling and lack of response facilities. This paper introduces a new tool for security event monitoring, analysis, and response called Savors. Savors provides suitable scalability by utilizing three additional areas of computing. High-end computing brings large amounts of on-demand processing to bear on the problem. Auralization allows both monitoring and analysis to be performed in parallel. Finally, grid computing provides the basis for remote data access and response capabilities with seamless and s...

• Type: Conference
• Year: 2007
• Where: ISVC
• Authors: Paul Z. Kolano
• Keywords: Attacks Makes Humans, Gather Large Quantities, ISVC 2007, Response Called Savors