Constructing attack scenarios through correlation of intrusion alerts

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2002, Pages 245-254

  Ning, Peng ^a   Cui, Yun ^a   Reeves, Douglas S ^a  

^a North Carolina State University   (United States)

Author keywords

Alert correlation; Attack scenarios; Intrusion detection

Indexed keywords

COMPUTER CRIME; COMPUTER SIMULATION; DATABASE SYSTEMS; ENCODING (SYMBOLS); JAVA PROGRAMMING LANGUAGE; KNOWLEDGE BASED SYSTEMS; RESPONSE TIME (COMPUTER SYSTEMS); XML;

ALERT CORRELATION; ATTACK SCENARIOS; DISTRIBUTED DENIAL OF SERVICE ATTACK; INTRUSION DETECTION;

SECURITY OF DATA;

EID: 0038011185     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/586143.586144     Document Type: Conference Paper

References (18)

1. J. P. Anderson. Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., Fort Washington, PA, 1980.
2. AT & T Research Labs. GraphViz - open source graph layout and drawing software. http://www.research.att.com/sw/tools/graphviz/.
3. R. Bace. Intrusion Detection. Macmillan Technology Publishing, 2000.
4. F. Cuppens and A. Miege. Alert correlation in a cooperative intrusion detection framework. In Proc. of the 2002 IEEE Symposium on Security and Privacy, May 2002.
5. F. Cuppens and R. Ortalo. LAMBDA: A language to model a database for detection of attacks. In Proc. of Recent Advances in Intrusion Detection (RAID 2000), pages 197-216, September 2000.
6. O. Dain and R. Cunningham. Fusing a heterogeneous alert stream into scenarios. In Proc. of the 2001 ACM Workshop on Data Mining for Security Applications, pages 1-13, Nov. 2001.
7. H. Debar and A. Wespi. Aggregation and correlation of intrusion-detection alerts. In Recent Advances in Intrusion Detection, LNCS 2212, pages 85 - 103, 2001.
8. ISS, Inc. RealSecure intrusion detection system. http://www.iss.net.
9. S. Jha, O. Sheyner, and J. Wing. Two formal analyses of attack graphs. In Proc. of the 15th Computer Security Foundation Workshop, June 2002.
10. MIT Lincoln Lab. 2000 DARPA intrusion detection scenario specific datasets. http://www.11.mit.edu/IST/ideval/data/2000/2000_data_index.html, 2000.
11. P. Ning, Y. Cui, and D. S. Reeves, Analyzing intensive intrusion alerts via correlation. In Proc. of the 5th Int'l Symposium on Recent Advances in Intrusion Detection (RAID 2002), October 2002.
12. P. Ning, Y. Cui, and D. S. Reeves. Constructing attack scenarios through correlation of intrusion alerts (full version). Technical Report TR-2002-13, North Carolina State University, Department of Computer Science, August 2002.
13. P. Ning and D. Xu. Adapting query optimization techniques for efficient intrusion alert correlation. Technical Report TR-2002-14, North Carolina State University, Department of Computer Scienc, September 2002.
14. R. Ritchey and P. Ammann. Using model checking to analyze network vulnerabilities. In Proc. of IEEE Symposium on Security and Privacy, pages 156-165, May 2000.
15. O. Sheyner, J. Haines, S. Jha, R. Lippmann, and J. Wing. Automated generation and analysis of attack graphs. In Proc. of IEEE Symposium on Security and Privacy, May 2002.
16. S. Staniford, J. Hoagland, and J. McAlerney. Practical automated detection of stealthy portscans. To appear in Journal of Computer Security, 2002.
17. S. Templeton and K. Levit. A requires/provides model for computer attacks. In Proc. of New Security Paradigms Workshop, pages 31 - 38. September 2000.
18. A. Valdes and K. Skinner. Probabilistic alert correlation. In Proc. of the 4th Int'l Symposium on Recent Advances in Intrusion Detection (RAID 2001), pages 54-68, 2001.