2026-07-20T05:58:19Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:1497 2024-03-06T11:08:00Z ddc:004 open_access

6. 08102 Working Group – Requirements for Network Monitoring from an IDS Perspective Braun, Lothar Dressler, Falko Holz, Thorsten Kirda, Engin Kohlrausch, Jan Kruegel, Christopher Limmer, Tobias Rieck, Konrad Sterbenz, James Intrusion detection and prevention attack response and countermeasures reactive security automated security survivability and self-protection ma network monitoring flow analysis denial of service detection and response event correlation Detection of malicious traffic is based on its input data, the information that is co-ming from network-based monitoring systems. Best detection rates would only be possible by monitoring all data transferred over all network lines in a distributed net-work. Monitoring and reporting this amount of data are feasible in neither today's, nor will be in future's systems. Later analysis like stateful inspection of the traffic imposes even more processing costs. But only at this level of monitoring and analysis there may be a chance to capture all attacks inside a system. So there needs to be a trade-off between detection success and the processing costs. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Lothar Braun and Falko Dressler and Thorsten Holz and Engin Kirda and Jan Kohlrausch and Christopher Kruegel and Tobias Limmer and Konrad Rieck and James Sterbenz 2008 Is Part Of Dagstuhl Seminar Proceedings, Volume 8102, Perspectives Workshop: Network Attack Detection and Defense (2008) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/DagSemProc.08102.6 urn:nbn:de:0030-drops-14970 https://drops.dagstuhl.de/entities/document/10.4230/DagSemProc.08102.6 eng https://creativecommons.org/licenses/by/4.0/legalcode