A comprehensive approach to intrusion detection alert correlation

被引：224

作者：

Valeur, F ^{[1
]}

Vigna, G ^{[1
]}

Kruegel, C ^{[1
]}

Kemmerer, RA ^{[1
]}

机构：

[1] Univ Calif Santa Barbara, Dept Comp Sci, Santa Barbara, CA 93106 USA

来源：

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING | 2004年 / 1卷 / 03期

关键词：

intrusion detection; alert correlation; alert reduction; correlation data sets;

D O I：

10.1109/TDSC.2004.21

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

Alert correlation is a process that analyzes the alerts produced by one or more intrusion detection systems and provides a more succinct and high-level view of occurring or attempted intrusions. Even though the correlation process is often presented as a single step, the analysis is actually carried out by a number of components, each of which has a specific goal. Unfortunately, most approaches to correlation concentrate on just a few components of the process, providing formalisms and techniques that address only specific correlation issues. This paper presents a general correlation model that includes a comprehensive set of components and a framework based on this model. A tool using the framework has been applied to a number of well-known intrusion detection data sets to identify how each component contributes to the overall goals of correlation. The results of these experiments show that the correlation components are effective in achieving alert reduction and abstraction. They also show that the effectiveness of a component depends heavily on the nature of the data set analyzed.

引用

页码：146 / 169

页数：24

共 49 条

[1]

Andersson D., 2002, P 3 ANN IEEE INF ASS

[2]

ARBOI M, 2002, NESSUS ATTACK SCRIPT

[3]

BELLOVIN SM, 1992, PACKETS FOUND INTERN

[4] Modeling multistep cyber attacks for scenario recognition [J].

Cheung, S ;

Lindqvist, U ;

Fong, MW .

DARPA INFORMATION SURVIVABILITY CONFERENCE AND EXPOSITION, VOL I, PROCEEDINGS, 2003, :284-292

[5]

CUPPENS F, 2002, P IEEE S SEC PRIV MA

[6]

Curry D., 2003, INTRUSION DETECTION

[7]

Debar H., 2001, P 4 INT S REC ADV IN, P85, DOI DOI 10.1007/3-540-45474-8_

[8] AN INTRUSION-DETECTION MODEL [J].

DENNING, DE .

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 1987, 13 (02) :222-232

[9]

DESAI N, 2003, IDS CORRELATION VA D

[10] Testing and evaluating computer intrusion detection systems [J].

Durst, R ;

Champion, T ;

Witten, B ;

Miller, E ;

Spagnuolo, L .

COMMUNICATIONS OF THE ACM, 1999, 42 (07) :53-61

← 1 2 3 4 5 →