Lessons Learned from Automated Sharing of Intrusion Detection Alerts: The Case of the SABU Platform

Logo poskytovatele

Varování

Publikace nespadá pod Pedagogickou fakultu, ale pod Ústav výpočetní techniky. Oficiální stránka publikace je na webu muni.cz.
Autoři

HUSÁK Martin SOKOL Pavol ŽÁDNÍK Martin BARTOŠ Václav HORÁK Martin

Rok publikování 2023
Druh Článek v odborném periodiku
Časopis / Zdroj Digital Threats: Research and Practice
Fakulta / Pracoviště MU

Ústav výpočetní techniky

Citace
www https://dl.acm.org/doi/10.1145/3611391
Doi http://dx.doi.org/10.1145/3611391
Klíčová slova Cybersecurity;information sharing;intrusion detection;automation
Přiložené soubory
Popis Sharing the alerts from intrusion detection systems among multiple computer networks and organizations allows for seeing the “big picture” of the network security situation and improves the capabilities of cyber incident response. However, such a task requires a number of technical and non-technical issues to be resolved, from data collection and distribution to proper categorization, data quality management, and issues of trust and privacy. In this field note, we illustrate the concepts and provide lessons learned on the example of SABU, an alert sharing and analysis platform used by academia and partner organizations in the Czech Republic. We discuss the initial willingness to share the data that was later weakened by the uncertainties around personal data protection, the issues of high volume and low quality of the data that prevented their straightforward use, and that the management of the community is a more severe issue than the technical implementation of alert sharing.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.