Information Assurance

16.4. Conclusion

Analyzing fault and security alarms is very crucial for identifying and localizing network problems such as failure or intrusions. In this chapter, we show how to integrate fault and security management to relieve the heavy burden of manual diagnostics by system administrators and improve the accuracy of fault and intrusion identification. In the first section, a novel technique called active integrated fault reasoning, or AIR, is presented. This technique is the first to seamlessly integrate passive and active fault reasoning in order to reduce fault detection times as well as improve the accuracy of fault diagnosis. AIR can be similarly used to correlate security alarms and identify potential intrusions or attacks. In case ...