Alert Correlation Using a Novel Clustering Approach

Mohamed, Ashara Banu; Idris, Norbik Bashah; Shanmugum, Bharanidharan

doi:10.1109/csnt.2012.212

Cited by 9 publications

(5 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most researchers analyze IDS alerts in terms of signs of network flows, such as IP addresses, ports, protocols, and others. Mohamed et al [19] use the target asset and destination IP address as alert attributes to identify patterns of attacks against specific assets. They combine alert attributes into clusters, and calculate the hash sum of each cluster for later comparison and similarity.…”

Section: A Similarity-based Methods 1) Attribute-based Methodsmentioning

confidence: 99%

Systematic Literature Review of Security Event Correlation Methods

2022

View full text Add to dashboard Cite

Security event correlation approaches are necessary to detect and predict incremental threats such as multi-step or targeted attacks (advanced persistent threats) and other causal sequences of abnormal events. The use of security event correlation techniques also makes it possible to reduce the volume of the original data stream by grouping the events and eliminating their redundancy. The variety of event correlation methods, in turn, requires choosing the most appropriate way to handle security events, depending on the purpose and available resources. This paper presents a systematization of security event correlation methods into several categories, such as publication year, applied correlation methods, knowledge extraction methods, used data sources, architectural solutions, and quality evaluation of correlation methods. The research method is a systematic literature review, which includes the formulation of research questions, the choice of keywords and criteria for inclusion and exclusion. The review corpus is formed by using search queries in Google Scholar, IEEE Xplore, ACM Digital Library, ScienceDirect, and selection criteria. The final review corpus includes 127 publications from the existing literature for 2010-2021 and reflects the current state of research in the security event correlation field. The results of the analysis include the main directions of research in the field of event correlation and methods used for correlation both single events and their sequences in attack scenarios. The review also describes the datasets and metrics used to evaluate security event correlation approaches. In conclusion, the existing problems and possible ways to overcome them are identified. The main contribution of the review is the most complete classification and comparison of existing approaches to the security event correlation, considered not only from the point of view of the algorithm, but also the possibility of unknown attack detection, architectural solutions and the use of event initial data.

show abstract

Section: A Similarity-based Methods 1) Attribute-based Methodsmentioning

confidence: 99%

Systematic Literature Review of Security Event Correlation Methods

2022

View full text Add to dashboard Cite

show abstract

“…The authors maintained the AOI techniques, and worked on the over generalization problem and computational setbacks in the Julish's work through developing a new approximation clustering algorithm while introducing the Nearest Common Ancestor (NCA) concept as a tool to calculate distance and initiate the cluster. Mohamed et al [15] argue that the data mining approaches applied in the previous work are not suitable because of the generalization technique operates on pure assumption that alerts can be grouped together because they shared some common features or belong to the same ancestor. Secondly, the usage of distance measurement not only creates room for error while clustering but also indicates high computational cost since distance will have to be calculated between every single alert and each existing cluster.…”

Section: A Hierarchical Clustering Algorithmmentioning

confidence: 99%

A taxonomy on intrusion alert aggregation techniques

Ahmed

Siraj

Zainal

et al. 2014

2014 International Symposium on Biometrics and Security Technologies (ISBAST)

View full text Add to dashboard Cite

As security threats advance in a drastic way, most of the organizations apply various intrusion detection systems (IDSs) to optimize detection and to provide comprehensive view of intrusion activities. But IDS produces huge number of duplicated alerts information that overwhelm security operator. Alert aggregation addresses this issue by reducing, fusing and clustering the alerts. Techniques from a different scope of disciplines have been proposed by researchers for different aspects of aggregation. In this paper we present a comprehensive review on proposed alert aggregation techniques. Our main contribution is to classify the literature based on the techniques applied to aggregate the alerts.

show abstract

“…The revised taxonomy of alert processing illustrated in [9], indicates that both techniques are being implemented by research in the process of developing the ultimate solution. Feature selection is the common entity of data reduction which being used in all researches; nonetheless, there are many others that used additional reduction techniques before applying the correlation techniques in their research.…”

Section: Related Workmentioning

confidence: 99%

“…Due to the detection mechanism and configuration of the sensors, the numbers of alerts generated daily are huge; therefore, efforts in trying to find the best processing method is very important as the implementation of IDS grew among practitioners worldwide. In the midst of finding the best method, many ideas and solution were proposed, which could be grouped into data reduction and correlation techniques; conversely researches that generate the best result are the one that incorporate both techniques in one solution [9]. Managing the alerts generated by the IDS sensors has to be conducted systematically and efficiently; this is to maintain the accuracy of the alerts to be processed.…”

Section: Related Workmentioning

confidence: 99%

An Operational Framework for Alert Correlation using a Novel Clustering Approach

Mohamed¹,

Idris²,

Shanmugum³

2012

IJCA

Self Cite

View full text Add to dashboard Cite

Intrusion Detection System (IDS) is a well known security feature and widely implemented among practitioners. However, since the creation of IDS the enormous number of alerts generated by the detection sensors has always been a setback in the implementation environment. Moreover due to this obtrusive predicament, two other problems have emerged which are the difficulty in processing the alerts accurately and also the decrease in performance rate in terms of time and memory capacity while processing these alerts. Thus, based on the specified problems, the purpose of our overall research is to construct a holistic solution that is able to reduce the number of alerts to be processed and at the same time to produce a high quality attack scenarios that are meaningful to the administrators in a timely manner. In this paper we will present our proposed framework together with the result of our novel clustering method, architectured solely with the intention of reducing the amount of alerts generated by IDS. The clustering method was tested against two dataset; a globally used dataset, DARPA and a live dataset from a cyber attack monitoring unit that uses SNORT engine to capture the alerts. The result obtained from the experiment is very promising; the clustering algorithm was able to reduce about 86.9% of the alerts used in the experiment. From the result we are able to highlight the contribution to practitioners in an actual working environment.

show abstract

Alert Correlation Using a Novel Clustering Approach

Cited by 9 publications

References 30 publications

Systematic Literature Review of Security Event Correlation Methods

Systematic Literature Review of Security Event Correlation Methods

A taxonomy on intrusion alert aggregation techniques

An Operational Framework for Alert Correlation using a Novel Clustering Approach

Contact Info

Product

Resources

About