Skip to Main content Skip to Navigation
Theses

Classification du trafic et optimisation des règles de filtrage pour la détection d'intrusions

Abstract : In this dissertation we are interested by some bottlenecks that the intrusion detection faces, namely the high load traffic, the evasion techniques and the false alerts generation. In order to ensure the supervision of overloaded networks, we classify the traffic using Intrusion Detection Systems (IDS) characteristics and network security policies. Therefore each IDS supervises less IP traffic and uses less detection rules (with respect to traffics it analyses). In addition we reduce the packets time processing by a wise attack detection rules application. During this analysis we rely on a fly pattern matching strategy of several attack signatures. Thus we avoid the traffic reassembly previously used to deceive evasion techniques. Besides, we employ the protocol analysis with decision tree in order to accelerate the intrusion detection and reduce the number of false positives noticed when using a raw pattern matching method.
Document type :
Theses
Complete list of metadata

Cited literature [183 references]  Display  Hide  Download

https://hal.univ-lorraine.fr/tel-01746733
Contributor : Thèses Ul <>
Submitted on : Thursday, March 29, 2018 - 10:43:41 AM
Last modification on : Monday, October 19, 2020 - 11:10:27 AM
Long-term archiving on: : Thursday, September 13, 2018 - 1:28:09 PM

File

SCD_T_2004_0192_ABBES.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-01746733, version 1

Collections

Citation

Tarek Abbes. Classification du trafic et optimisation des règles de filtrage pour la détection d'intrusions. Autre [cs.OH]. Université Henri Poincaré - Nancy 1, 2004. Français. ⟨NNT : 2004NAN10192⟩. ⟨tel-01746733⟩

Share

Metrics

Record views

182

Files downloads

176