<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01401302</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T23:03:48+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Enhancing Network Intrusion Detection by Correlation of Modularly Hashed Sketches</title>
            <author role="aut">
              <persName>
                <forename type="first">Martin</forename>
                <surname>Drašar</surname>
              </persName>
              <email type="md5">3d4e90499bd57693c7c380ad4ce4e7bf</email>
              <email type="domain">ics.muni.cz</email>
              <idno type="idhal" notation="numeric">994071</idno>
              <idno type="halauthorid" notation="string">1083295-994071</idno>
              <affiliation ref="#struct-412450"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Tomáš</forename>
                <surname>Jirsík</surname>
              </persName>
              <email type="md5">a920da8835d8846557a71e85af7cc8aa</email>
              <email type="domain">ics.muni.cz</email>
              <idno type="idhal" notation="numeric">994057</idno>
              <idno type="halauthorid" notation="string">1083283-994057</idno>
              <affiliation ref="#struct-412450"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Martin</forename>
                <surname>Vizváry</surname>
              </persName>
              <email type="md5">0a036bb844570c88507e6140c18ee282</email>
              <email type="domain">ics.muni.cz</email>
              <idno type="idhal" notation="numeric">994065</idno>
              <idno type="halauthorid" notation="string">1083289-994065</idno>
              <affiliation ref="#struct-412450"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-11-23 10:26:44</date>
              <date type="whenModified">2025-04-16 09:38:30</date>
              <date type="whenReleased">2016-11-23 10:37:35</date>
              <date type="whenProduced">2014-06-30</date>
              <date type="whenEndEmbargoed">2017-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01401302v1/document">
                <date notBefore="2017-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01401302v1/file/978-3-662-43862-6_19_Chapter.pdf" id="file-1401302-1486613">
                <date notBefore="2017-01-01"/>
              </ref>
              <ref type="externalLink" target="https://is.muni.cz/repo/1192611/Enhancing_Network_Intrusion_Detection_by_Correlation_of_Modularly_Hashed_Sketches.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01401302</idno>
            <idno type="halUri">https://inria.hal.science/hal-01401302</idno>
            <idno type="halBibtex">drasar:hal-01401302</idno>
            <idno type="halRefHtml">&lt;i&gt;8th IFIP International Conference on Autonomous Infrastructure, Management and Security (AIMS)&lt;/i&gt;, Jun 2014, Brno, Czech Republic. pp.160-172, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-662-43862-6_19"&gt;&amp;#x27E8;10.1007/978-3-662-43862-6_19&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">8th IFIP International Conference on Autonomous Infrastructure, Management and Security (AIMS), Jun 2014, Brno, Czech Republic. pp.160-172, &amp;#x27E8;10.1007/978-3-662-43862-6_19&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1401302-1486613"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC6" corresp="IFIP-TC">TC 6: Communication Systems</idno>
            <idno type="stamp" n="IFIP-AIMS">IFIP-AIMS</idno>
            <idno type="stamp" n="IFIP-WG6-6">Management of Networks and Distributed Systems</idno>
            <idno type="stamp" n="IFIP-LNCS-8508" corresp="IFIP-LNCS">Monitoring and Securing Virtualized Networks and Services</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 6: Monitoring Methods for Quality-of-Service and Security</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Enhancing Network Intrusion Detection by Correlation of Modularly Hashed Sketches</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Martin</forename>
                    <surname>Drašar</surname>
                  </persName>
                  <email type="md5">3d4e90499bd57693c7c380ad4ce4e7bf</email>
                  <email type="domain">ics.muni.cz</email>
                  <idno type="idhal" notation="numeric">994071</idno>
                  <idno type="halauthorid" notation="string">1083295-994071</idno>
                  <affiliation ref="#struct-412450"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Tomáš</forename>
                    <surname>Jirsík</surname>
                  </persName>
                  <email type="md5">a920da8835d8846557a71e85af7cc8aa</email>
                  <email type="domain">ics.muni.cz</email>
                  <idno type="idhal" notation="numeric">994057</idno>
                  <idno type="halauthorid" notation="string">1083283-994057</idno>
                  <affiliation ref="#struct-412450"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Martin</forename>
                    <surname>Vizváry</surname>
                  </persName>
                  <email type="md5">0a036bb844570c88507e6140c18ee282</email>
                  <email type="domain">ics.muni.cz</email>
                  <idno type="idhal" notation="numeric">994065</idno>
                  <idno type="halauthorid" notation="string">1083289-994065</idno>
                  <affiliation ref="#struct-412450"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">Lecture Notes in Computer Science</title>
                <meeting>
                  <title>8th IFIP International Conference on Autonomous Infrastructure, Management and Security (AIMS)</title>
                  <date type="start">2014-06-30</date>
                  <date type="end">2014-07-03</date>
                  <settlement>Brno</settlement>
                  <country key="CZ">Czech Republic</country>
                </meeting>
                <editor>Anna Sperotto</editor>
                <editor>Guillaume Doyen</editor>
                <editor>Steven Latré</editor>
                <editor>Marinos Charalambides</editor>
                <editor>Burkhard Stiller</editor>
                <imprint>
                  <publisher>Springer</publisher>
                  <biblScope unit="serie">Monitoring and Securing Virtualized Networks and Services</biblScope>
                  <biblScope unit="volume">LNCS-8508</biblScope>
                  <biblScope unit="pp">160-172</biblScope>
                  <date type="datePub">2014</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-662-43862-6_19</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>The rapid development of network technologies entails an increase in traffic volume and attack count. The associated increase in computational complexity for methods of deep packet inspection has driven the development of behavioral detection methods. These methods distinguish attackers from valid users by measuring how closely their behavior resembles known anomalous behavior. In real-life deployment, an attacker is flagged only on very close resemblance to avoid false positives. However, many attacks can then go undetected. We believe that this problem can be solved by using more detection methods and then correlating their results. These methods can be set to higher sensitivity, and false positives are then reduced by accepting only attacks reported from more sources. To this end we propose a novel sketch-based method that can detect attackers using a correlation of particular anomaly detections. This is in contrast with the current use of sketch-based methods that focuses on the detection of heavy hitters and heavy changes. We illustrate the potential of our method by detecting attacks on RDP and SSH authentication by correlating four methods detecting the following anomalies: source network scan, destination network scan, abnormal connection count, and low traffic variance. We evaluate our method in terms of detection capabilities compared to other deployed detection methods, hardware requirements, and the attacker’s ability to evade detection.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 6</org>
              <org type="consortium">WG 6.6</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="regroupinstitution" xml:id="struct-412450" status="VALID">
          <idno type="IdRef">030138566</idno>
          <idno type="ISNI">0000000121940956</idno>
          <idno type="ROR">https://ror.org/02j46qs45</idno>
          <idno type="Wikidata">Q763586</idno>
          <orgName>Masaryk University [Brno] = Masarykova univerzita [Brno] = Université Masaryk [Brno]</orgName>
          <orgName type="acronym">MU / MUNI</orgName>
          <date type="start">1919-01-28</date>
          <desc>
            <address>
              <addrLine>Žerotínovo nám. 617/9 – 601 77 Brno – Czech Republic</addrLine>
              <country key="CZ"/>
            </address>
            <ref type="url">https://www.muni.cz/en</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>