Browsing by Author "Toprak, Mustafa"

Now showing 1 - 2 of 2

Intrusion detection system alert correlation with operating system level logs
(Izmir Institute of Technology, 2009) Toprak, Mustafa; Aytaç, İsmail Sıtkı
Internet is a global public network. More and more people are getting connected to the Internet every day to take advantage of the Internetwork connectivity. It also brings in a lot of risk on the Internet because there are both harmless and harmful users on the Internet. While an organization makes its information system available to harmless Internet users, at the same time the information is available to the malicious users as well. Most organizations deploy firewalls to protect their private network from the public network. But, no network can be hundred percent secured. This is because; the connectivity requires some kind of access to be granted on the internal systems to Internet users. The firewall provides security by allowing only specific services through it. The firewall implements defined rules to each packet reaching to its network interface. The IDS complements the firewall security by detected if someone tries to break in through the firewall or manages to break in the firewall security and tried to have access on any system in the trusted site and alerted the system administrator in case there is a breach in security. However, at present, IDSs suffer from several limitations. To address these limitations and learn network security threats, it is necessary to perform alert correlation. Alert correlation focuses on discovering various relationships between individual alerts. Intrusion alert correlation techniques correlate alerts into meaningful groups or attack scenarios for ease to understand by human analysts. In order to be sure about the alert correlation working properly, this thesis proposed to use attack scenarios by correlating alerts on the basis of prerequisites and consequences of intrusions. The architecture of the experimental environment based on the prerequisites and consequences of different types of attacks, the proposed approach correlates alerts by matching the consequence of some previous alerts and the prerequisite of some later ones with OS-level logs. As a result, the accuracy of the proposed method and its advantage demonstrated to focus on building IDS alert correlation with OS-level logs in information security systems.
A lattice-based approach for news chain construction
(Izmir Institute of Technology, 2015-07) Toprak, Mustafa; Tekir, Selma; Allmer, Jens
Each news article and column can be part of a manually created news story or chain by journalists and columnists. However, increasing amounts of data published by news companies each year makes manual analysis thus creation of news stories and chains almost impossible. When the amount of data is considered, it is obvious that automated systems’ support is vital to journalists, columnists and intelligence analysts. A news chain is a set of news articles that form a connected and coherent whole. In the traditional “connecting the dots” approach, news chains are constructed based on given two articles as start and end news of the chain. In this study, a method is proposed to create coherent news chains without the predetermination of start and end articles of the chain. Intuition of the method comes from the partial order relation among news articles. We try to show that lattice structure can represent relation or hierarchy among news articles that have a partial order in nature. Creating concept lattice is prepared out of the inverted index structure of news articles which is one of the main contributions of the study. In the experimental work, an artificial dataset is processed to show the steps of the method. After that, we also provide the evaluation using real dataset results.