Real-time correlation of network security alerts

Proceedings - ICEBE 2007: IEEE International Conference on e-Business Engineering - Workshops: SOAIC 2007; SOSE 2007; SOKM 2007

Volumn , Issue , 2007, Pages 73-80

  Zhitang, Li ^a   Aifang, Zhang ^a   Jie, Lei ^a   Li, Wang ^a  

^a HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

CORRELATION METHODS; ELECTRONIC COMMERCE; INTERNET; PUBLIC WORKS; SEQUENTIAL SWITCHING; SPECIFICATIONS; STATISTICAL TESTS;

ALERT CORRELATIONS; ATTACK BEHAVIOR; E BUSINESS; INTERNATIONAL CONFERENCES; NETWORK ADMINISTRATORS; NOVEL METHODS; PRECISE ATTACK; REAL NETWORKS; REAL TIME; SECURITY ALERTS; SECURITY DEVICES; SEQUENTIAL PATTERN MINING ALGORITHMS; TEST DATASET; TIME CORRELATIONS;

NETWORK SECURITY;

EID: 47349110308     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICEBE.2007.69     Document Type: Conference Paper

References (20)

1. Valdes, A., Skinner, K.: Probabilistic alert correlation. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection (RAID), October 2001.
2. Valdes, A., Skinner, K.: Adaptive, Model-Based Monitoring for Cyber Attack Detection. In Proceedings of the third International Workshop, Recent Advances in Intrusion Detection (RAID) 2000, Springer-Verlag Lecture Notes in Computer Science, October 2000.
3. Dain, O. M., Cunningham,. Building Scenarios from a Heterogeneous Alert Stream. In IEEE Workshop on Information Assurance and Security, United States Military Academy, West Point, NY, 5-6 June 2001.
4. Lee, W., Qin, X.: Statistical Causality Analysis of INFOSEC Alert Data. In: RAID2003.
5. Qin, X, Lee, W.: Discovering novel attack strategies from INFOSEC alerts. In: Sophia Antipolis, France, 2004.
6. Qin, X: A Probabilistic-Based Framework for INFOSEC Alert Correlation. In: College of Computing Georgia Institute of Technology, Aug. 2005.
7. Debar, H., Wespi, A.:Aggregation and Correlation of Intrusion-Detection Alerts. In Proceedings of the 4th International Symposium, Recent Advances in Intrusion Detection (RAID) 2001, Springer-Verlag Lecture Notes in Computer Science, October 2001.
8. P. Ning, Y. Cui, and D. S. Reeves: Constructing attack scenarios through correlation of intrusion alerts. In Proceedings of the 9th ACM Conference on Computer and Communications Security, Nov 18-22 2002, Washington, DC, United States, 2002.
9. P. Ning, Y. Cui, D. S. Reeves, and D. Xu: Techniques and tools for analyzing intrusion alerts. In: ACM Transactions on Information and System Security, vol. 7, pp. 274, 2004.
10. P. Ning and D. Xu: Alert correlation through triggering events and common resources. Tucson, AZ, USA, 2004.
11. F. Cuppens. : Managing alerts in multi-intrusion detection environment. In: Proceedings 17th annual computer security applications conference. New Orleans; 2001.
12. F. Cuppens, A. Miège: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE symposium on security and privacy; 2002.
13. F. Cuppens, F. Autrel, A. Miège, S. Benferhat.: Correlation in an intrusion detection process. In: Proceedings SE'curite' des communications sur internet (SECI02); 2002.
14. S. Cheung, U. Lindqvist, M. W. Fong: Modeling multistep cyber attacks for scenario recognition. In: Proceedings of the Third DARPA Information Conference and Exposition (DISCEX III), Washington, D.C., April 2003.
15. J. L. Hellerstein and S. Ma: Mining Event Data for Actionable Patterns. In: Proceedings of the CMG 2000 International Conference, Orlando, FL, December 2000, The Computer Measurement Group (2000).
16. R. Agrawal and R. Srikant: Mining sequential patterns. In: Research Report RJ 9910, IBM Almaden Research Center, San Jose, California, October 1994.
17. Eschelbeck, G. and Krieger, M., Eliminating noise from intrusion detection systems. Information Security Technical Report, 8(4): 26. 2003.
18. Gula, R.: Correlating IDS Alerts with Vulnerability Information. Tenable Network Security. 2002.technical report.
19. Kruegel, C. and Robertson, W., Alert Verification: Determining the Success of Intrusion Attempts, In: Proceeding of First Workshop the Detection of Intrusions and Malware and Vulnerability Assessment 2004.
20. Porras, P.A., Fong, M.W., Valdes, A.: A mission-impact-based approach to INFOSEC alarm correlation. In: 5th International Symposium Recent Advances in Intrusion Detection.2002