Entry Ryu:2008:EID from tissec.bib

Last update: Sun Oct 15 02:58:48 MDT 2017                Valid HTML 3.2!

Index sections

Top | Symbols | Numbers | Math | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

BibTeX entry

@Article{Ryu:2008:EID,
  author =       "Young U. Ryu and Hyeun-Suk Rhee",
  title =        "Evaluation of Intrusion Detection Systems Under a
                 Resource Constraint",
  journal =      j-TISSEC,
  volume =       "11",
  number =       "4",
  pages =        "20:1--20:??",
  month =        jul,
  year =         "2008",
  CODEN =        "ATISBQ",
  DOI =          "https://doi.org/10.1145/1380564.1380566",
  ISSN =         "1094-9224 (print), 1557-7406 (electronic)",
  ISSN-L =       "1094-9224",
  bibdate =      "Tue Aug 5 19:37:22 MDT 2008",
  bibsource =    "http://portal.acm.org/;
                 http://www.math.utah.edu/pub/tex/bib/tissec.bib",
  abstract =     "An intrusion detection system plays an important role
                 in a firm's overall security protection. Its main
                 purpose is to identify potentially intrusive events and
                 alert the security personnel to the danger. A typical
                 intrusion detection system, however, is known to be
                 imperfect in detection of intrusive events, resulting
                 in high false-alarm rates. Nevertheless, current
                 intrusion detection models unreasonably assume that
                 upon alerts raised by a system, an information security
                 officer responds to all alarms without any delay and
                 avoids damages of hostile activities. This assumption
                 of responding to all alarms with no time lag is often
                 impracticable. As a result, the benefit of an intrusion
                 detection system can be overestimated by current
                 intrusion detection models. In this article, we extend
                 previous models by including an information security
                 officer's alarm inspection under a constraint as a part
                 of the process in determining the optimal intrusion
                 detection policy. Given a potentially hostile
                 environment for a firm, in which the intrusion rates
                 and costs associated with intrusion and security
                 officers' inspection can be estimated, we outline a
                 framework to establish the optimal operating points for
                 intrusion detection systems under security officers'
                 inspection constraint. The optimal solution to the
                 model will provide not only a basis of better
                 evaluation of intrusion detection systems but also
                 useful insights into operations of intrusion detection
                 systems. The firm can estimate expected benefits for
                 running intrusion detection systems and establish a
                 basis for increase in security personnel to relax
                 security officers' inspection constraint.",
  acknowledgement = ack-nhfb,
  articleno =    "20",
  fjournal =     "ACM Transactions on Information and System Security",
  journal-URL =  "http://portal.acm.org/browse_dl.cfm?idx=J789",
  keywords =     "computer security; intrusion detection; optimal
                 inspection rates; optimal operating points",
}

Related entries