@conference{2007_JITEL_N3,
author = "Rolando Salazar-Hern{\'a}ndez and Jes{\'u}s Esteban D{\'i}az Verdejo and Garc{\'i}a-Teodoro, Pedro  and Maci{\'a}-Fern{\'a}ndez, Gabriel  and Francisco de Toro Negro",
abstract = "The Nearest Normal Neighbor (N3) is an anomaly-based intrusion detection system which
has demonstrated a good performance in terms of detection capabilities when applied to the HTTP
protocol. Nevertheless, N3 presents a high computational cost, as it is based in the comparison of the
target HTTP payload against every payload in the normality model. The cost is proportional to the
length of the payloads and to the number of elements in the model. The present paper explores the use
of the hash functions as a method to reduce the computational cost of the system by decreasing the
average length of the payloads. The model is, therefore, composed by fixed length hashes of each
payload in the original model, and the hash of the target payload is compared against this model. The
results obtained for SHA256 and SHA512 show a big decrease in computational cost with a reduced
impact in system’s performance.",
editor = "VI Jornadas Ingenier{\'i}a Telem{\'a}tica, JITEL 2007",
title = "{U}so de {F}unciones {C}ompendio en la {D}etecci{\'o}n de {A}nomal{\'i}as mediante {N}3",
url = "http://ceres.ugr.es/~gmacia/papers/Jitel07_N3.pdf",
year = "2007",
}