Real-time alert stream clustering and correlation for discovering attack strategies

Proceedings - 5th International Conference on Fuzzy Systems and Knowledge Discovery, FSKD 2008

Volumn 4, Issue , 2008, Pages 379-384

  Jie, Ma ^a   Li, Zhi Tang ^a   Li, Wei Ming ^a  

^a HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; CORRELATION METHODS; FUZZY LOGIC; FUZZY SYSTEMS; INTERNET; INTRUSION DETECTION; SECURITY OF DATA;

ALERT CLUSTERING; ATTACK BEHAVIORS; ATTACK SCENARIOS; ATTACK STRATEGIES; CORRELATION TECHNIQUES; MULTISTAGE ATTACKS; NETWORK ADMINISTRATORS; NETWORK INTRUSION DETECTION SYSTEMS; PRIOR KNOWLEDGES; SECURITY ADMINISTRATORS; SEQUENTIAL PATTERNS; STREAM CLUSTERING; TIME HORIZONS; TIME PERIODS; VARIOUS ATTACKS;

REAL TIME SYSTEMS;

EID: 58049209409     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/FSKD.2008.522     Document Type: Conference Paper

References (11)

1. P. Ning, Y. Cui, D. S. Reeves, and D. Xu: Techniques and tools for analyzing intrusion alerts. In: ACM Transactions on Information and System Security, vol. 7, pp. 274, 2004.
2. Cuppens, F., Ortalo, R. LAMBDA: A language to model a database for detection of attacks. In: Proc. of Recent Advances in Intrusion Detection, 2000: 197-216
3. J. L.Hellerstein, S. Ma, and C.-S. Perng. Discovering actionable patterns in event data. IBM Systems Journal, 2002, 41: 475
4. C. Araujo, A. Biazetti, A. Bussani, J. Dinger, M. Feridun, and A. Tanner. Simplifying correlation rule creation for effective systems monitoring. In: 15th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2004 Proceedings. Davis, CA, USA., 15-17 Nov. 2004: 266-268
5. P. Ning, Y. Cui, and D. S. Reeves: Constructing attack scenarios through correlation of intrusion alerts. In Proceedings of the 9th ACM Conference on Computer and Communications Security, Nov 18-22 2002, Washington, DC, United States, 2002.
6. P. Ning, Y. Cui, D. S. Reeves, and D. Xu: Techniques and tools for analyzing intrusion alerts. In: ACM Transactions on Information and System Security, vol. 7, pp.274, 2004.
7. F. Cuppens.: Managing alerts in multi-intrusion detection environment. In: Proceedings 17th annual computer security applications conference. New Orleans; 2001.
8. F. Cuppens, A. Miege: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE symposium on security and privacy; 2002.
9. C. C. Aggarwal, J. Han, J. Wang, P. Yu. A Framework for Clustering Evolving Data Streams. VLDB Conference, 2003.
10. Srikant R, Agrawal R. Mining sequential patterns: Generalizations and performance improvements. In: Proc. International Conference on Extending Database Technology, EDBT'96, Avignon, France, 1996: 3-17
11. MIT Lincoln Lab. 2000 DARPA Intrusion Detection ScenarioSpecificDataSets. http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.htm