CSDL Home A ARES 2008 2012 Seventh International Conference on Availability, Reliability and Security
Mar. 4, 2008 to Mar. 7, 2008
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ARES.2008.38
Surprisingly few data collection mechanisms have been used for intrusion detection, and most systems rely on network and system call data as input to the detection engine. Even though the quality of log data is vital to the detection process and heavily dependent on the collection mechanism, no extensive survey or taxonomy has beenconducted within the detection field. In this paper, we propose a revised taxonomy which provides a unified terminology and a framework in which data collection mechanisms can be systematically inspected, evaluated, and compared. Since the taxonomy is derived from existing mechanisms, it also provides a useful overview of different types of mechanisms. The paper also suggests areas within data collection where additional work is required.
Taxonomy, Intrusion detection, Data collection
Ulf Larson, Erland Jonsson, Stefan Lindskog, "A Revised Taxonomy of Data Collection Mechanisms with a Focus on Intrusion Detection", ARES, 2008, 2012 Seventh International Conference on Availability, Reliability and Security, 2012 Seventh International Conference on Availability, Reliability and Security 2008, pp. 624-629, doi:10.1109/ARES.2008.38