Evaluating Reputation of Internet Entities

Evaluating Reputation of Internet Entities

Paper in proceedings (conference paper)

Security monitoring tools, such as honeypots, IDS, behavioral analysis or anomaly detection systems, generate large amounts of security events or alerts. These alerts are often shared within some communities using various alert sharing systems. Our research is focused on analysis of the huge amount of data present in these systems. In this work we focus on summarizing all alerts and other information known about a network entity into a measure called reputation score expressing the level of threat the entity poses. Computation of the reputation score is based on estimating probability of future attacks caused by the entity.

Security monitoring tools, such as honeypots, IDS, behavioral analysis or anomaly detection systems, generate large amounts of security events or alerts. These alerts are often shared within some communities using various alert sharing systems. Our research is focused on analysis of the huge amount of data present in these systems. In this work we focus on summarizing all alerts and other information known about a network entity into a measure called reputation score expressing the level of threat the entity poses. Computation of the reputation score is based on estimating probability of future attacks caused by the entity.

network, security, reputation, threat intelligence

network, security, reputation, threat intelligence

BARTOŠ, V.; KOŘENEK, J.

2017

20.06.2016

Springer International Publishing

Munich

978-3-319-39813-6

Management and Security in the Age of Hyperconnectivity

Lecture Notes in Computer Science

9701

132

136

5