Attack scenario construction with a new sequential mining technique

Proceedings - SNPD 2007: Eighth ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing

Volumn 1, Issue , 2007, Pages 872-877

  Li, Wang ^a   Zhi tang, Li ^a   Dong, Li ^a   Jie, Lei ^a  

^a HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (China)

Author keywords

Attack scenario construction; Correlativity; Sequential mining

Indexed keywords

CORRELATION THEORY; DATA MINING; DATABASE SYSTEMS; MATHEMATICAL MODELS; ONLINE SYSTEMS; REDUNDANCY;

ADVANCED ALERT CORRELATION SYSTEMS; ATTACK SCENARIO CONSTRUCTION; ATTACK STRATEGIES; HIGH LEVEL ALERT DATABASE;

SECURITY OF DATA;

EID: 35148893691     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SNPD.2007.185     Document Type: Conference Paper

References (13)

1. Fre'de'ric Cuppens. Managing alerts in multi-intrusion detection environment. In: Proceedings 17th annual computer security applications conference, New Orleans; 2001. p. 22e31.
2. Fre'de'ric Cuppens, Alexandre Mie'ge. Alert correlation in a cooperative intrusion detection framework, In: Proceedings of the 2002 IEEE symposium on security and privacy; 2002, p. 202e15.
3. Fre'de'ric Cuppens, Fabien Autrel, Alexandre Mie'ge, Salem Benferhat, Correlation in an intrusion detection process, In: Proceedings SE'curite' des communications sur internet (SECI02); 2002, p. 153e71.
4. P. Ning, Y. Cui, and D. S. Reeves, "Constructing attack scenarios through correlation of intrusion alerts," presented at Proceedings of the 9th ACM Conference on Computer and Communications Security, Nov 18-22 2002, Washington, DC, United States, 2002.
5. P. Ning, Y. Cui, D. S. Reeves, and D. Xu, "Techniques and tools for analyzing intrusion alerts," ACM Transactions on Information and System Security, vol. 7, pp, 274, 2004.
6. P. Ning and D. Xu, "Alert correlation through triggering events and common resources," Tucson, AZ, USA, 2004
7. Sheyner, O., Haines, J., Jha, S., Lippmann, R., and Wing, J. M., "Automated generation and analysis of attack graphs" in Proceedings of the 2002 IEEE Symposium on Security and Privacy, (Oakland, CA), May 2002.
8. W. Lee and X. Qin, "Statistical Causality Analysis of INFOSEC Alert Data," presented at RAID2003.
9. Q. Xinzhou and L. Wenke, "Discovering novel attack strategies from INFOSEC alerts," Sophia Antipolis, France, 2004.
10. R. Agrawal and R. Srikant, "Mining sequential patterns," Research Report RJ 9910, IBM Almaden Research Center, San Jose, California, October 1994.
11. MIT Lincoln Lab, 2000 DARPA Intrusion Detection Scenario Specific Data Sets, http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html
12. Aaron Turner, TCPreplay32 tools. http://tcpreplay.synfin.net/trac/
13. Xinzhou Qin, "A Probabilistic-Based Framework for INFOSEC Alert Correlation", College of Computing Georgia Institute of Technology, Aug, 2005.