@inproceedings{ morin_m2d2:_2002,
  address = {Zurich, Switzerland},
  series = {Lecture {Notes} in {Computer} {Science}},
  title = {M2D2: {A} formal data model for {IDS} alert correlation},
  volume = {2516},
  isbn = {3-540-00020-8},
  url = {http://link.springer.com/chapter/10.1007%2F3-540-36084-0_7},
  doi = {10.1007/3-540-36084-0<sub>7</sub>},
  abstract = {At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.},
  booktitle = {Proceedings of the 5th {International} {Conference} on {Recent} {Advances} in {Intrusion} {Detection} ({RAID}'02)},
  publisher = {Springer-Verlag},
  author = {Morin, Benjamin and Mé, Ludovic and Debar, Hervé and Ducassé, Mireille},
  editor = {Wespi, Andreas and Vigna, Giovanni and Deri, Luca},
  year = {2002},
  note = {00262 bibtex: morin2002m2d2 
bibtex[numpages=23;acmid=1754711]},
  keywords = {Intrusion detection, alert correlation},
  pages = {115--137}
}

{"_id":{"_str":"5298aa259eb585cc2600099f"},"__v":0,"authorIDs":[],"author_short":["Morin, B.","Mé, L.","Debar, H.","Ducassé, M."],"bibbaseid":"morin-m-debar-ducass-m2d2aformaldatamodelforidsalertcorrelation-2002","bibdata":{"abstract":"At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.","address":"Zurich, Switzerland","author":["Morin, Benjamin","Mé, Ludovic","Debar, Hervé","Ducassé, Mireille"],"author_short":["Morin, B.","Mé, L.","Debar, H.","Ducassé, M."],"bibtex":"@inproceedings{ morin_m2d2:_2002,\n address = {Zurich, Switzerland},\n series = {Lecture {Notes} in {Computer} {Science}},\n title = {M2D2: {A} formal data model for {IDS} alert correlation},\n volume = {2516},\n isbn = {3-540-00020-8},\n url = {http://link.springer.com/chapter/10.1007%2F3-540-36084-0_7},\n doi = {10.1007/3-540-36084-0₇},\n abstract = {At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.},\n booktitle = {Proceedings of the 5th {International} {Conference} on {Recent} {Advances} in {Intrusion} {Detection} ({RAID}'02)},\n publisher = {Springer-Verlag},\n author = {Morin, Benjamin and Mé, Ludovic and Debar, Hervé and Ducassé, Mireille},\n editor = {Wespi, Andreas and Vigna, Giovanni and Deri, Luca},\n year = {2002},\n note = {00262 bibtex: morin2002m2d2 \nbibtex[numpages=23;acmid=1754711]},\n keywords = {Intrusion detection, alert correlation},\n pages = {115--137}\n}","bibtype":"inproceedings","booktitle":"Proceedings of the 5th International Conference on Recent Advances in Intrusion Detection (RAID'02)","doi":"10.1007/3-540-36084-0₇","editor":["Wespi, Andreas","Vigna, Giovanni","Deri, Luca"],"editor_short":["Wespi, A.","Vigna, G.","Deri, L."],"id":"morin_m2d2:_2002","isbn":"3-540-00020-8","key":"morin_m2d2:_2002","keywords":"Intrusion detection, alert correlation","note":"00262 bibtex: morin2002m2d2 bibtex[numpages=23;acmid=1754711]","pages":"115--137","publisher":"Springer-Verlag","series":"Lecture Notes in Computer Science","title":"M2D2: A formal data model for IDS alert correlation","type":"inproceedings","url":"http://link.springer.com/chapter/10.1007%2F3-540-36084-0_7","volume":"2516","year":"2002","bibbaseid":"morin-m-debar-ducass-m2d2aformaldatamodelforidsalertcorrelation-2002","role":"author","urls":{"Paper":"http://link.springer.com/chapter/10.1007%2F3-540-36084-0_7"},"keyword":["Intrusion detection","alert correlation"],"downloads":0},"bibtype":"inproceedings","biburl":"http://bibbase.org/zotero/ealprr","downloads":0,"keywords":["intrusion detection","alert correlation"],"search_terms":["m2d2","formal","data","model","ids","alert","correlation","morin","mé","debar","ducassé"],"title":"M2D2: A formal data model for IDS alert correlation","year":2002,"dataSources":["fcy64Zdm28gydMmuE"]}