Skip to Main content Skip to Navigation

Classification du trafic et optimisation des règles de filtrage pour la détection d'intrusions

Abstract : In this dissertation we are interested by some bottlenecks that the intrusion detection faces, namely the high load traffic, the evasion techniques and the false alerts generation. In order to ensure the supervision of overloaded networks, we classify the traffic using Intrusion Detection Systems (IDS) characteristics and network security policies. Therefore each IDS supervises less IP traffic and uses less detection rules (with respect to traffics it analyses). In addition we reduce the packets time processing by a wise attack detection rules application. During this analysis we rely on a fly pattern matching strategy of several attack signatures. Thus we avoid the traffic reassembly previously used to deceive evasion techniques. Besides, we employ the protocol analysis with decision tree in order to accelerate the intrusion detection and reduce the number of false positives noticed when using a raw pattern matching method.
Document type :
Complete list of metadata

Cited literature [183 references]  Display  Hide  Download
Contributor : Thèses Ul <>
Submitted on : Thursday, March 29, 2018 - 10:43:41 AM
Last modification on : Monday, October 19, 2020 - 11:10:27 AM
Long-term archiving on: : Thursday, September 13, 2018 - 1:28:09 PM


Files produced by the author(s)


  • HAL Id : tel-01746733, version 1



Tarek Abbes. Classification du trafic et optimisation des règles de filtrage pour la détection d'intrusions. Autre [cs.OH]. Université Henri Poincaré - Nancy 1, 2004. Français. ⟨NNT : 2004NAN10192⟩. ⟨tel-01746733⟩



Record views


Files downloads