Alert correlation framework using a novel clustering approach

Mohamed, Ashara Banu; Idris, Norbik Bashah; Shanmugum, Bharanidharan

doi:10.1109/iccisci.2012.6297279

Cited by 5 publications

(3 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…False alarm minimization schemes based on correlating IDS alarms with network vulnerabilities are proposed in . These schemes use reference numbers of vulnerabilities along with other context information parameters to verify the TP alarms.…”

Section: Related Workmentioning

confidence: 99%

False alarm reduction in signature‐based IDS: game theory approach

Subba

Biswas

Karmakar

2016

Security Comm Networks

View full text Add to dashboard Cite

Signature‐based intrusion detection systems (IDSs) are employed to monitor computer networks for signs of network intrusions. However, they produce a large number of false positive alarms when operated with default settings without considering the underlying network environment. Inundation of false alarms is the Achilles heel of IDS technology, which could render the IDS ineffective in detecting network attacks. Several false alarm minimization approaches have been proposed in the literature. However, there are many drawbacks associated with these works, namely, modification of well‐established attack signatures; heavy dependence on the attack signatures' reference numbers, which might not always be available; and non‐consideration of the underlying network context information. In this paper, we propose an efficient game theory‐based false alarm minimization scheme for signature‐based IDS. The proposed scheme uses a game theory‐based correlation engine to correlate IDS alarms with network vulnerabilities to minimize the overall false positive alarm rate of the IDS. Experimental results and comparison analysis of the proposed false alarm minimization framework with other frameworks on the benchmark DARPA intrusion detection evaluation dataset and an in‐house IIT Guwahati Lab dataset show that the proposed scheme achieves the highest accuracy among all the frameworks under consideration without degrading the overall detection rate of the IDS. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Section: Related Workmentioning

confidence: 99%

False alarm reduction in signature‐based IDS: game theory approach

Subba

Biswas

Karmakar

2016

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…This study provided the development directions of CSA and offered conclusions from issue, technical, and application systems. Recently, [22,23] proposed a network threat assessment based on alert verification. Tian et al [24] also proposed a method to quantitatively assess network threat situations based on alerts and contextual information.…”

Section: Introductionmentioning

confidence: 99%

Multitask Learning-Based Security Event Forecast Methods for Wireless Sensor Networks

Zhang

Wang

et al. 2016

Journal of Sensors

View full text Add to dashboard Cite

Wireless sensor networks have strong dynamics and uncertainty, including network topological changes, node disappearance or addition, and facing various threats. First, to strengthen the detection adaptability of wireless sensor networks to various security attacks, a region similarity multitask-based security event forecast method for wireless sensor networks is proposed. This method performs topology partitioning on a large-scale sensor network and calculates the similarity degree among regional subnetworks. The trend of unknown network security events can be predicted through multitask learning of the occurrence and transmission characteristics of known network security events. Second, in case of lacking regional data, the quantitative trend of unknown regional network security events can be calculated. This study introduces a sensor network security event forecast method named Prediction Network Security Incomplete Unmarked Data (PNSIUD) method to forecast missing attack data in the target region according to the known partial data in similar regions. Experimental results indicate that for an unknown security event forecast the forecast accuracy and effects of the similarity forecast algorithm are better than those of single-task learning method. At the same time, the forecast accuracy of the PNSIUD method is better than that of the traditional support vector machine method.

show abstract

“…Their proposed framework and the novel clustering method, architectured solely with the intention of reducing the amount of alerts generated by IDS. The clustering method was tested against two datasets; a globally used dataset, DARPA and a live dataset from a cyber attack monitoring unit that uses Snort engine to capture the alerts [34].…”

Section: Related Workmentioning

confidence: 99%

Reducing the Correlation Processing Time by Using a Novel Intrusion Alert Correlation Model

Elshoush¹

2014

SpecialIssue

View full text Add to dashboard Cite

Abstract-Alert correlation analyzes the alerts from one or more Collaborative Intrusion Detection Systems (CIDSs) to produce a concise overview of security-related activity on the network. The correlation process consists of multiple components, each responsible for a different aspect of the overall correlation goal. The sequential order of the correlation components affects the correlation process performance. Furthermore, the total time needed for the whole process depends on the number of processed alerts in each component. This paper presents an innovative alert correlation framework that minimizes the number of processed alerts on each component and thus reducing the correlation processing time. By reordering the components, the introduced correlation model reduces the number of processed alerts as early as possible by discarding the irrelevant, unreal and false alerts in the early phases of the correlation process. A new component, shushing the alerts, is added to deal with the unrelated and false positive alerts. A modified algorithm for fusing the alerts is outlined. The intruders' intention is grouped into attack scenarios and thus used to detect future attacks. DARPA 2000 intrusion detection scenario specific datasets and a testbed network were used to evaluate the innovative alert correlation model. Comparisons with a previous correlation system were performed. The results of processing these datasets and recognizing the attack patterns demonstrated the potential of the improved correlation model and gave favorable results.

show abstract

Alert correlation framework using a novel clustering approach

Cited by 5 publications

References 25 publications

False alarm reduction in signature‐based IDS: game theory approach

False alarm reduction in signature‐based IDS: game theory approach

Multitask Learning-Based Security Event Forecast Methods for Wireless Sensor Networks

Reducing the Correlation Processing Time by Using a Novel Intrusion Alert Correlation Model

Contact Info

Product

Resources

About