Discovering novel attack strategies from INFOSEC alerts

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3193, Issue , 2004, Pages 439-456

  Qin, Xinzhou ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BAYESIAN NETWORKS; DOMAIN KNOWLEDGE; TIME SERIES ANALYSIS;

ATTACK STRATEGIES; ATTACKS SCENARIOS; BAYESIAN; COMPLEMENTARY CORRELATION; DOMAIN KNOWLEDGE; INFOSEC ALERTS; MECHANISM-BASED; SECURITIES ANALYSTS; SECURITY ALERTS; STATE OF SYSTEM;

ENGINES;

EID: 35048901618     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-30108-0_27     Document Type: Article

References (30)

1. E. Bauer, D. Koller, and Y. Singer. Update rules for parameter estimation in Bayesian networks. In Proceedings of the Thirteenth Conference on Uncertainty in Artificial Intelligence (UAI), pages 3-13, Providence, RI, August 1997.
2. J. B. D. Cabrera, L. Lewis, X. Qin, W. Lee, and R. K. Mehra. Proactive intrusion detection and distributed denial of service attacks - a case study in security management. Journal of Network and Systems Management, vol. 10(no. 2), June 2002.
3. J. B. D. Cabrera, L. Lewis, X. Qin, W. Lee, R. K. Prasanth, B. Ravichandran, and R. K. Mehra. Proactive detection of distributed denial of service attacks using mib traffic variables - a feasibility study. In Proceedings of IFIP/IEEE International Symposium on Integrated Network Management (IM 2001), May 2001.
4. P. E. Caines and C. W. Chan. Feedback between stationary stastic process. IEEE Transactions on Automatic Control, 20:495-508, 1975.
5. S. Cheung, U. Lindqvist, and M. W. Fong. Modeling multistep cyber attacks for scenario recognition. In Proceedings of the Third DARPA Information Survivability Conference and Exposition (DISCEX III), Washington, D.C., April 2003.
6. I. Cohen, A. Bronstein, and F. G. Cozman. Online learning of bayesian network parameters. Hewlett Packard Laboratories Technical Report, HPL-2001-55(R.1), June 2001.
7. F. Cuppens and A. Miège. Alert correlation in a cooperative intrusion detection framework. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, pages 202-215, Oakland, CA, May 2002.
8. DAPRA Cyber Panel Program. DARPA cyber panel program grand challenge problem (GCP). http://www.grandchallengeproblem.net/, 2003.
9. H. Debar and A. Wespi. The intrusion-detection console correlation mechanism. In 4th International Symposium on Recent Advances in Intrusion Detection (RAID), October 2001.
10. C. W. Geib and R. P. Goldman. Plan recognition in intrusion detection system. In DARPA Information Survivability Conference and Exposition (DISCEX II), June 2001.
11. M. R. Gevers and B. D. O. Anderson. Representations of jointly stationary stochastic feedback processes. International Journal of Control, 33:777-809, 1981.
12. R. P. Goldman, W. Heimerdinger, and S. A. Harp. Information modleing for intrusion report aggregation. In DARPA Information Survivability Conference and Exposition (DISCEX II), June 2001.
13. C. W. J. Granger. Investigating causal relations by econometric methods and cross-spectral methods. Econometrica, 34:424-428, 1969.
14. IETF Intrusion Detection Working Group. Intrusion detection message exchange format. http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-09.txt, 2002.
15. J. Haines, D. K. Ryder, L. Tinnel, and S. Taylor. Validation of sensor alert correlators. IEEE Security & Privacy Magazine, January/February, 2003.
16. W. Hesse, E. Moller, M. Arnold, H. Witte, and B. Schack. Investigation of time-variant causal interactions between two eeg signals by means of the adaptive granger causality. Brain Topography, 15:265-266, 2003.
17. M. Kaminski, M. Ding, W.A. Truccolo, and S. L. Bressler. Evaluating causal relations in neural systems: Granger causality, direct transfer function (dtf) and statistical assessment of significance. Biological Cybernetics, 85:145-157, 2001.
18. R. K. Kaufamnn and D. I. Stern. Evidence for human influence on climate from hemispheric temperature relations. Nature, 388:39-44, July 1997.
19. H. Lee, K. S. Lin, and J. Wu. Pitfalls in using granger causality tests to find an engine of growth. Applied Economics Letters, 9:411-414, May 2002.
20. G. M. Ljung and G. E. P. Box. On a measure of lack of fit in time series models. In Biometrika 65, pages 297-303, 1978.
21. B. Morin and H. Debar. Correlation of intrusion symptoms: an application of chronicles. In Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection (RAID 2003), Pittsburgh, PA, September 2003.
22. P. Ning, Y. Cui, and D.S. Reeves. Constructing attack scenarios through correlation of intrusion alerts. In 9th ACM Conference on Computer and Communications Security, November 2002.
23. P. Ning and D. Xu. Learnign attack strategies from intrusion alerts. In Proceedings of 10th ACM Conference on Computer and Communications Security (CCS'03), October 2003.
24. P. Ning, D. Xu, C. G. Healey, and R. A. Amant. Building attack scenarios through integration of complementary alert correlation methods. In Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS'04), San Diego, CA, February 2004.
25. J. Pearl. Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference. Morgan Kaufmann Publishers, Inc, 1988.
26. P. A. Porras, M. W. Fong, and A. Valdes. A Mission-Impact-Based approach to INFOSEC alarm correlation. In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID), October 2002.
27. X. Qin and W. Lee. Statistical causality analysis of infosec alert data. In Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection (RAID 2003), Pittsburgh, PA, September 2003.
28. S. M. Ross. Introduction to Probability Models. Harcourt Academic Press, 7th edition, 2000.
29. W. Stallings. SNMP, SNMPv2, SNMPv3, and RMON 1 and 2. Addison-Wesley, 1999.
30. A. Valdes and K. Skinner. Probabilistic alert correlation. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection (RAID), October 2001.