A Survey of Intrusion Alert Correlation and Its Design Considerations

Leau, Yu‐Beng; Ramadass, Sureswaran; Manickam, Selvakumar; Fun, Tan Soo

doi:10.1080/02564602.2014.906864

Cited by 22 publications

(8 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Predicting the next activities of the attacker is an imperative and difficult task [13,20,81,82]. Prediction encourages intrusion frameworks to respond appropriately before the network is compromised and gives the chances to overcome the benefits of the attacker.…”

Section: Discussion and Future Research Directionmentioning

confidence: 99%

“…Table 1 shows the comparison of proposed survey with the existing survey articles, such as [13][14][15][16] focus on alert correlation techniques or a mapping among framework techniques and components. No articles comprehensively reviewed cyber-attack prediction based on intrusion alert correlation techniques, considering the intrusion alert dataset.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey

Albasheer

Siraj

Mubarakali

et al. 2022

Sensors

View full text Add to dashboard Cite

Network Intrusion Detection Systems (NIDS) are designed to safeguard the security needs of enterprise networks against cyber-attacks. However, NIDS networks suffer from several limitations, such as generating a high volume of low-quality alerts. Moreover, 99% of the alerts produced by NIDSs are false positives. As well, the prediction of future actions of an attacker is one of the most important goals here. The study has reviewed the state-of-the-art cyber-attack prediction based on NIDS Intrusion Alert, its models, and limitations. The taxonomy of intrusion alert correlation (AC) is introduced, which includes similarity-based, statistical-based, knowledge-based, and hybrid-based approaches. Moreover, the classification of alert correlation components was also introduced. Alert Correlation Datasets and future research directions are highlighted. The AC receives raw alerts to identify the association between different alerts, linking each alert to its related contextual information and predicting a forthcoming alert/attack. It provides a timely, concise, and high-level view of the network security situation. This review can serve as a benchmark for researchers and industries for Network Intrusion Detection Systems’ future progress and development.

show abstract

Section: Discussion and Future Research Directionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey

Albasheer

Siraj

Mubarakali

et al. 2022

Sensors

View full text Add to dashboard Cite

show abstract

“…Replay Attack. A replay attack is a replay of any previous neighbor or router discovery message to obtain network access [20]. The attacker can capture the NDP message and send it again later.…”

Section: Fig 3 Example Of Na Spoofingmentioning

confidence: 99%

Review of Security Vulnerabilities in the IPv6 Neighbor Discovery Protocol

Anbar

Abdullah

Saad

et al. 2016

Lecture Notes in Electrical Engineering

View full text Add to dashboard Cite

Abstract& Internet Protocol version 6 (IPv6) contains a new protocol, Neighbor Discovery Protocol (NDP), that replaces Address Resolution Protocol (ARP) in Internet Protocol version 4 (IPv4), router discovery, and redirect. If implemented without any security mechanism, NDP contains vulnerabilities. Using spoofed Media Access Control (MAC) addresses in an NDP message, a malicious host can launch Denial-of -Service or Man-in-the-Middle attacks. IPv6 depends heavily on NDP, which appears in the network in the form of ICMPv6. If ICMP is disabled or dropped from the network, IPv6 does not operate, in contrast to IPv4. The importance of the NDP protocol in the IPv6 network is that it catches attackers' attention on NDP vulnerabilities that they can exploit. This paper describes and reviews some of the fundamental attacks on NDP, prevention mechanisms, and current detection mechanisms for NDP-based attacks.Keywords Internet Protocol version 6 (IPv6) · Neighbor Discovery Protocol (NDP) · Address Resolution Protocol (ARP) · Man-in-the-Middle (MiTM) · Denial-of-Service (DoS)

show abstract

“…This method based on Spearman's Correlation Coefficient to drags out the correlative data's in the scrutinized information attribute that is the complete record of the stakeholders. The aspects are shown in the results [20] Take a random information set contains x 1, x 2 ,x 3…. x n, Let X 1 = { x 1, x 2 ,x 3….…”

Section: Multivariate Correlation Analysis Using Spearmanmentioning

confidence: 99%

Detecting and Preventing of Attacks in Cloud Computing Using Hybrid Algorithm

Aashmi¹,

Jaya²

2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

Cloud computing is the technology that is currently used to provide users with infrastructure, platform, and software services effectively. Under this system, Platform as a Service (PaaS) offers a medium headed for a web development platform that uniformly distributes the requests and resources. Hackers using Denial of service (DoS) and Distributed Denial of Service (DDoS) attacks abruptly interrupt these requests. Even though several existing methods like signature-based, statistical anomaly-based, and stateful protocol analysis are available, they are not sufficient enough to get rid of Denial of service (DoS) and Distributed Denial of Service (DDoS) attacks and hence there is a great need for a definite algorithm. Concerning this issue, we propose an improved hybrid algorithm which is a combination of Multivariate correlation analysis, Spearman coefficient, and mitigation technique. It can easily differentiate common traffic and attack traffic. Not only that, it greatly helps the network to distribute the resources only for authenticated requests. The effects of comparing with the normalized information have shown an extra encouraging detection accuracy of 99% for the numerous DoS attack as well as DDoS attacks.Keywords: Hybrid algorithm (HA); distributed denial of service (DDoS); denial of service (DoS); platform as a service (PaaS); infrastructure as a service (IaaS); software as a service (SaaS)

show abstract

A Survey of Intrusion Alert Correlation and Its Design Considerations

Cited by 22 publications

References 19 publications

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey

Review of Security Vulnerabilities in the IPv6 Neighbor Discovery Protocol

Detecting and Preventing of Attacks in Cloud Computing Using Hybrid Algorithm

Contact Info

Product

Resources

About