Real-time alert correlation with type graphs

The premise of automated alert correlation is to accept that false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which attacks can be combined. These algorithms can be classified in to two broad categories namely scenario-graph approaches, which create an attack model starting from a vulnerability assessment and type-graph approaches which rely on an abstract model of the relations between attack types. Some research in to improving the efficiency of type-graph correlation has been carried out but this research has ignored the hypothesizing of missing alerts. Our work is to present a novel type-graph algorithm which unifies correlation and hypothesizing in to a single operation. Our experimental results indicate that the approach is extremely efficient in the face of intensive alerts and produces compact output graphs comparable to other techniques.

CD-ROM Acrobat Journals Using Networks

The available technologies for publishing journals electronically are surveyed. They range from abstract representations, such as SGML, concerned largely with the structure of the document, to formats such as PostScript which faithfully model the layout and the appearance. The issues are discussed in the context of choosing a format for electronically publishing the journal: Electronic Publishing -- Origination, Dissemination and Design. PostScript is neither widely enough available nor standardised enough to be suitable; a bitmapped pages approach suffers from being resolution-dependent in terms of the visual quality achievable. Reasons are put forward for the final choice of Adobe s new PDF document standard for creating electronic versions of the journal.