![](bg8.png)
intrusion is not sufficient; each generated alert must
be clearly labeled to be taken into account.
5 CONCLUSION
Intrusions are clearly taking place and thus there is a
need for operational supervision systems today. Ex-
perience shows that a pragmatic approach needs to be
taken in order to implement a professional SOC that
can provide reliable results. The SOCBox is our re-
sponse to these new threats.
During its evaluation, the SOCBox proved that it
is a powerful tool giving the cartography of network
security in a graphical and ergonomic way. It gen-
erates clear reports including graphs for helping the
security managers better and has an interface for se-
curity alert consulting. It also has the ability to com-
pact similar alerts to facilitate the legibility of the gen-
erated reports; this can be a great advantage during a
troubleshooting operation for example. Moreover, the
SOCBox does not need a powerful host: its detection
performance is closely linked to the capacity of the
sensors to send it their logs.
REFERENCES
Aaron, T. and Matt, B. (2005). Tcpreplay tool (2.3).
http://tcpreplay.sourceforge.net.
Anderson, J. (1980). Computer security threat monitoring
and surveillance. Technical report.
Avallone, S., Guadagno, S., Emma, D., Pescape, A., and
Ventre, G. (2004). D-itg distributed internet traffic
generator.
Bidou, R., Bourgeois, J., and Spies, F. (2003). Towards
a global security architecture for intrusion detection
and reaction management. In 4th Int. workshop on
information security applications, pages 111–123.
Cuppens, F. (2001). Managing alerts in a multi-intrusion
detection environment. In 17th Annual Computer Se-
curity Applications Conference, New-Orleans.
Debar, H., Morin, D., and Wespi, A. (1998). Reference au-
dit information generation for intrusion detection sys-
tems. In Proceedings of IFIPSEC 98, pages 405–417.
Heberlein, T., Dias, V., Levitt, K., Mukherjee, B., Wood,
J., and Wolber, D. (1990). A network security moni-
tor. In IEEE Symposium on Research in Security and
Privacy, pages 296–304.
Lippman, R., Haines, J. W., Fried, D. J., Korba, J., and Ku-
mar, D. (2000). Analysis and results of the 1999 darpa
off-line intrusion detection evaluation. In 3th sympo-
sium on Recent Advances in Intrusion Detection 2000,
pages 162–182.
Neumann, P. G. and Porras, P. A. (1999). Experience with
EMERALD to date. In First USENIX Workshop on
Intrusion Detection and Network Monitoring, pages
73–80, Santa Clara, California.
Northcutt, S. and Novak, J. (2002). Network Intrusion De-
tection. ISBN: 0-73571-265-4. New Riders, third edi-
tion edition. September.
NSS-Group (2001). Intrusion detection systems group tests
(edition 2). http://www.nss.co.uk/ids.
Openwall-Project (2006). John the ripper password cracker
(1.7). http://www.openwall.com/john/.
Ptacek, T. H. and Newsham, T. (1998). Insertion, evasion,
and denial of service: Eluding network intrusion de-
tection. Technical report, Secure Networks, Inc.
Puketza, N., Chung, M., Olsson, R., and Mukherjee, B.
(1997). A software platform for testing intrusion de-
tection systems. IEEE Software, 14(5):43–51.
Puppy, R. F. (2003). A look at whisker’s anti-ids tactics.
http://www.wiretrip.net/rfp/txt/whiskerids.html.
Schneier, B. (1999). Attacks trees. Dr. Dobb.
Snort (2005). Snort (2.4.3) lightweight intrusion detection
for networks http://www.snort.org/dl.
Sommers, J. (2005). Harpoon: A flow-level traffic generator
http://www.cs.wisc.edu/ jsommers/harpoon/.
Song, D. (2001a). Dsniff 2.3: A collection of
tools for network auditing and penetration testing
http://www.monkey.org/ dugsong/dsniff/.
Song, D. (2001b). Macof - flood a
switched lan with random mac addresses
http://www.groar.org/trad/dsniff/dsniff-2.3/english-
txt/macof.8.txt.
THC (2006). The hacker’s choice, thc releases, thc-hydra
v5.2. http://www.thc.org/releases.php.
Yu, J., Reddy, Y. V., Selliah, S., Reddy, S., Bharadwaj,
V., and Kankanahalli, S. (2005). TRINETR: An ar-
chitecture for collaborative intrusion detection and
knowledge-based alert evaluation. Advanced Engi-
neering Informatics, 19(2):93–101.
Zissman, M. (2002). Darpa intrusion detection evaluation
data sets. http://www.ll.mit.edu/ist/ideval/.
Zti-Telecom (2005). Ip traffic (2.3), a test and mesure tool.
http://www.zti-telecom.com/fr/pages/iptraffic-test-
measure.htm.
EVALUATION OF THE INTRUSION DETECTION CAPABILITIES AND PERFORMANCE OF A SECURITY
OPERATION CENTER
55