Structuring a Multi-violation Detectors Database for an Efficient Intrusion Detection
Amel Meddeb-Makhlouf, Mohamed Hamdi, Noureddine A. Boudriga · 2007
This paper proposes to manage data structures manipulated by the proposed correlation function based on a new concept called multi-violation detectors (MvD). The MvD-based correlation function manipulates events based on metrics that evaluate them. The detection and the correlation processes are managed using a MLP (multi-layer perceptron)-like network architecture. The manipulated data structures in the MLP-like network mainly include attacks, metrics and MvD values. To add more efficiency to the implemented processes, these values are managed through a structured database where an SQL-like language for MvD retrieval is introduced. The proposed approach is based on a relational calculus. Therefore, its completeness is mathematically proved.