An online adaptive approach to alert correlation

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6201 LNCS, Issue , 2010, Pages 153-172

  Ren, Hanli ^a   Stakhanova, Natalia ^a   Ghorbani, Ali A ^a  

^a UNIVERSITY OF NEW BRUNSWICK   (Canada)

Author keywords

alert correlation; Bayesian network

Indexed keywords

ADAPTIVE APPROACH; ALERT CORRELATION; ATTACK SCENARIOS; CAUSAL RELATIONSHIPS; DATA SETS; HONEYNET; INTRUSION ALERTS; INTRUSION DETECTION SYSTEMS; NETWORK ADMINISTRATOR; ON-THE-FLY; POTENTIAL STEPS; SYSTEM ADMINISTRATORS; TRAFFIC DATA; TWO STAGE;

BAYESIAN NETWORKS; COMPUTER CRIME; CORRELATION METHODS; DISTRIBUTED PARAMETER NETWORKS; INFERENCE ENGINES; INTELLIGENT NETWORKS;

INTRUSION DETECTION;

EID: 77955041904     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-14215-4_9     Document Type: Conference Paper

References (26)

1. Valdes, A., Skinner, K.: Probabilistic alert correlation. In: Lee, W., Ḿe, L., Wespi, A. (eds.) RAID 2001. LNCS, vol.2212, pp. 54-68. Springer, Heidelberg (2001)
2. Ning, P., Cui, Y., Reeves, D.S.: Constructing attacks scenarios through correlation of intrusion alerts. In: Proceedings of the 9th ACM conference on Computer and communications security, pp. 245-254 (2002)
3. Cheung, S., Lindqvist, U., Fong, M.: Modeling multistep cyber attacks for scenario recognition. In: DARPA Information Survivability Conference and Exposition, vol.1, pp. 284-292 (2003)
4. Cuppens, F., Miege, A.: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, pp. 202-215 (2002)
5. Cuppens, F., Ortalo, R.: A language to model a database for detection of attacks. In: Debar, H., Ḿe, L., Wu, S.F. (eds.) RAID 2000. LNCS, vol.1907, pp. 197-216. Springer, Heidelberg (2000)
6. Eckmann, S.T., Vigna, G., Kemmerer, R.A.: Statl: An attack language for statebased intrusion detection. Journal of Computer Security 10, 71-103 (2002)
7. Totel, E., Vivinis, B., Ḿe, L.: A language driven IDS for event and alert correlation. In: SEC, pp. 209-224 (2004)
8. Qin, X.: A probabilistic-based framework for INFOSEC alert correlation. In: Proceedings of the Symposium on Recent Advances in Intrusion Detection, vol.2820, pp. 73-93 (2003)
9. Zhu, B., Ghorbani, A.A.: Alert correlation for extracting attack strategies. International Journal of Network Security, 244-258 (2006)
10. Sadoddin, R., Ghorbani, A.A.: An incremental frequent structure mining framework for real-time alert correlation. Computers and Security 28, 153-173 (2009)
11. Zhang, S., Li, J., Chen, X., Fan, L.: Building network attack graph for alert causal correlation. Computers and Security 27, 188-196 (2008)
12. Maggia, F., Matteuccia, M., Zanero, S.: Reducing false positives in anomaly detectors through fuzzy alert aggregation. Information Fusion 10, 300-311 (2009)
13. Julisch, K.: Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security 6, 443-471 (2002)
14. Pietraszek, T.: Using adaptive alert classification to reduce false positives in intrusion detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol.3224, pp. 102-124. Springer, Heidelberg (2004)
15. Manganaris, S., Christensen, M., Zerkle, D., Hermiz, K.: A data mining analysis of rtid alarms. Computer Networks: The International Journal of Computer and Telecommunications Networking 34, 571-577 (2000)
16. Viinikka, J., Debar, H., Ḿe, L.: Processing intrusion detection alert aggregates with time series modeling. Information Fusion 10, 312-324 (2009)
17. Morin, B., Ḿe, L., Debar,H.,Ducasse, M.:M2d2: A formal datamodel for IDS alert correlation. In: Wespi, A., Vigna, G., Deri, L. (eds.) RAID 2002. LNCS, vol.2516, pp. 115-137. Springer, Heidelberg (2002)
18. Morin, B., Ḿe, L., Debar, H., Ducasse, M.: A logic-based model to support alert correlation in intrusion detection. Information Fusion 10, 285-299 (2009)
19. Porras, P.A., Fong, M.W., Valdes, A.: A mission-impact-based approach to infosec alarm correlation. In: Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection, pp. 95-114 (2002)
20. Dain, O.M., Cunningham, R.K.: Fusing a heterogeneous alert stream into scenarios. In: Proceeding of the 2001 ACM Workshop on Data Mining for Security Applications, pp. 1-13 (2001)
21. Qin, X., Lee, W.: Discovering novel attack strategies from INFOSEC alerts. In: Proceedings of the 9th European Symposium on Research in Computer Security, Sophia Antipolis, pp. 439-456 (2004)
22. Haykin, S.: Neural networks: A comprehensive foundation, 2nd edn. (1998)
23. Cristianini, N., Taylor, J.S.: An introduction to support vector machines and other kernel-based learning methods (2000)
24. Heckerman, D.: A tutorial on learning with bayesian networks. Technical Report MSR-TR-95-106, Microsoft Research (1995)
25. Laboratory, M.L.: 2000 darpa intrusion detection scenario specific datasets (2000)
26. netForensics Honeynet team: Honeynet traffic logs, http://old.honeynet. org/scans/scan34/