On the Use of Security Metrics Based on Intrusion Prevention System Event Data: An Empirical Analysis

TitleOn the Use of Security Metrics Based on Intrusion Prevention System Event Data: An Empirical Analysis
Publication TypeConference Papers
Year of Publication2008
AuthorsChrun D, Cukier M, Sneeringer G
Date Published2008/12//
Keywordsempirical analysis, Internet, Internet attack group, intrusion prevention system event data, network traffic monitoring, organization security metrics, security of data
Abstract

With the increasing number of attacks on the Internet, a primary concern for organizations is the protection of their network. To do so, organizations install security devices such as intrusion prevention systems to monitor network traffic. However, data that are collected by these devices are often imperfect. The contribution of this paper is to try to define some practical metrics based on imperfect data collected by an intrusion prevention system. Since attacks greatly differ, we propose to group the attacks into several attack type groups. We then define a set of metrics for each attack type group. We introduce an approach that consists in analyzing the evolution of these metrics per attack type group by focusing on outliers in order to give an insight into an organizationpsilas security. The method is assessed for an organization of about 40,000 computers. The results were encouraging: outliers could be related to security issues that, in some cases, had not been previously flagged.

DOI10.1109/HASE.2008.52