Check out the new USENIX Web site. next up previous
Next: Design requirements Up: Privacy-Preserving Sharing and Correlation Previous: Alert Sharing Infrastructure


Alert Sanitization

We propose several techniques that are used in combination to protect the alert sharing infrastructure from threats described in section 4. Some of the mechanisms are ``heavier'' than others and impose higher communication and computational requirements on alert contributors. On the other hand, they provide better protection against serious threats such as complete corruption of the alert repository. The exact set of techniques may be selected by each organization or contributor pool individually, depending on the level of trust they are willing to place in a particular repository or set of repositories.



Subsections

Vitaly Shmatikov 2004-05-18