A rule-based temporal alert correlation system

International Journal of Network Security

Volumn 5, Issue 1, 2007, Pages 66-72

  Kabiri, Peyman ^a   Ghorbani, Ali A ^b  

^a IRAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Iran)

^b UNIVERSITY OF NEW BRUNSWICK   (Canada)

Author keywords

Alert aggregation; Alert correlation; Intrusion detection; Temporal alert correlation

Indexed keywords

ALERT AGGREGATION; ALERT CORRELATION; ATTACK PATTERNS; INTRUSION DETECTION SYSTEMS; KNOWLEDGE BASE; RULE BASED; RULE-BASED APPROACH; SCENARIO-BASED;

INTRUSION DETECTION; KNOWLEDGE BASED SYSTEMS;

AGGREGATES;

EID: 74049131441     PISSN: 1816353X     EISSN: 18163548     Source Type: Journal    
DOI: None     Document Type: Article

References (9)

1. F. Cuppens, F. Autrel, A. Mige, and S. Benferhat, " Correlation in an intrusion detection process," in Proceedings of the Internet Security Communication Workshop (SECI'02) (Tunisia), pp. 153-172, Sept. 2002.
2. F. Cuppens, F. Autrel, A. Miege, and S. Benfer- hat, " Recognizing malicious intention in an intrusion detection process," in Proceedings of Second International Conference on Hybrid Intelligent Systems, pp. 806-817, Dec. 2002.
3. F. Cuppens and A. Miege, " Alert correlation in a cooperative intrusion detection framework," in Pro- ceedings of 2002 IEEE Symposium on Security and Privacy, pp. 202-215, 2002.
4. J. Kim, K. Kang, J. Na, I. Kim, K. Kim, J. Jang, and S. Sohn, " Practical network attack situation analy- sis using sliding window cache scheme," in The 9th Asia-Pacific Conference on Communications (APCC 2003), vol. 3, pp. 1038-1041, Sept. 2003.
5. S. Mathew, S. Chintan, and S. Upadhyaya, " An alert fusion framework for situation awareness of coor- dinated multistage attacks," in Proceedings of the Third IEEE International Workshop on Information Assurance (IWIA'05), pp. 95-104, 2005.
6. P. Ning, Y. Cui, and D. S. Reeves, " Construct- ing attack scenarios through correlation of intrusion alerts," in Proceedings of the 9th ACM conference on Computer and communication security (Washington D.C., USA), pp. 245-254, Nov. 2002.
7. P. Ning, Y. Cui, D. S. Reeves, and D. Xu, " Tech- niques and tools for analyzing intrusion alerts," ACM Transactions on Information and System Security, vol. 7, no. 2, pp. 274-318, 2004.
8. A. Valdes and K. Skinner, " Probabilistic alert cor- relation," in Proceedings of 4th International Sym- posium on Recent Advances in Intrusion Detection (RAID 2001), pp. 54-68, CA, USA, Oct. 2001.
9. F. Valeur, G. Vigna, C. Kruegel, and R. A. Kem- merer, " Comprehensive approach to intrusion detec- tion alert correlation," IEEE Transactions on De- pendable and Secure Computing, vol. 1, no. 3, pp. 146-169, 2004.