Alert Fusion Based on Cluster and Correlation Analysis

Xiao, Shisong; Zhang, Yugang; Liu, Xuejiao; Gao, Jingju

doi:10.1109/ichit.2008.197

Cited by 18 publications

(8 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Xu and Ning [44] Alsubhi et al [7] Xiao et al [45] Yu and Rubo [46] Frequency D Frequency represents the frequency of the similar incidents that occurred within a particular period of time. Unlike the similarity indicator, the frequency identifies the similarity between vulnerabilities in terms of number of occurrences within a particular period of time.…”

Section: Valdes and Skinner [47]mentioning

confidence: 99%

“…Organised as a tree, the hierarchy‐based approach consists of a set of specific–general relations, where leaf nodes denote the most specific concepts (original attributes value) and the root represents the most general concept in the hierarchy . For example, the hierarchy‐based approach has been used in many alert correlation studies in correlating alerts using IP address such as studies in and . In this study, the similarity indicator calculates its value using IP addresses and port similarity.…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…In this study, the similarity indicator calculates its value using IP addresses and port similarity. The contribution value for port similarity was based on functions used by a study in (i.e. Equations and ).…”

Section: Experimental Evaluationmentioning

confidence: 99%

See 2 more Smart Citations

Incident prioritisation using analytic hierarchy process (AHP): Risk Index Model (RIM)

Anuar

Papadaki

Furnell

et al. 2012

Security Comm Networks

View full text Add to dashboard Cite

The landscape of security threats continues to evolve, with attacks becoming more serious and the number of vulnerabilities rising. For these threats to be managed, many security studies have been undertaken in recent years, mainly focusing on improving detection, prevention and response efficiency. This paper proposes an incident prioritisation model, the Risk Index Model (RIM), which is based on risk assessment and the analytic hierarchy process. For incidents to be prioritised, the model uses indicators, such as criticality, as decision factors to calculate incidents' risk index. The model also adopts different strategies to enhance the prioritisation process. To evaluate the model, two stages of evaluation study were conducted. The first stage aims to validate the model by comparing its results with the Common Vulnerability Scoring System and Snort. The second stage aims to enhance RIM by analysing the effect of using different strategies in the model. The experimental results in the first stage have shown that 100% of incidents could be rated with RIM, compared with only 17.23% with the Common Vulnerability Scoring System. The experiments in the second stage have shown significant changes in the resultant risk index as well as some of the top‐priority incidents. Copyright © 2012 John Wiley & Sons, Ltd.

show abstract

Section: Valdes and Skinner [47]mentioning

confidence: 99%

Section: Experimental Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

Incident prioritisation using analytic hierarchy process (AHP): Risk Index Model (RIM)

Anuar

Papadaki

Furnell

et al. 2012

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…In particular, a cooperative module was proposed for intrusion detection, which implemented functions of alert management, clustering and correlation [32]. Xiao et al proposed a multilevel alert fusion model to abstract high-level attack scenarios to reduce redundancy [33]. As an alternative, fuzzy set theory was applied by Maggi et al to design robust alert aggregation algorithms [34].…”

Section: Related Workmentioning

confidence: 99%

Get Your Workload in Order: Game Theoretic Prioritization of Database Auditing

Yan

Vorobeychik

et al. 2018

2018 IEEE 34th International Conference on Data Engineering (ICDE)

View full text Add to dashboard Cite

The quantity of personal data that is collected, stored, and subsequently processed continues to grow at a rapid pace. Given its potential sensitivity, ensuring privacy protections has become a necessary component of database management. To enhance protection, a number of mechanisms have been developed, such as audit logging and alert triggers, which notify administrators about suspicious activities that may require investigation. However, this approach to auditing is limited in several respects. First, the volume of such alerts grows with the size of the database and is often substantially greater than the capabilities of resource-constrained organizations. Second, strategic attackers can attempt to disguise their actions or carefully choosing which records they touch, such as by limiting the number of database accesses they commit, thus potentially hiding illicit activity in plain sight. In this paper, we introduce a novel approach to database auditing that explicitly accounts for adversarial behavior by 1) prioritizing the order in which types of alerts are investigated and 2) providing an upper bound on how much resource to allocate for each type. Specifically, we model the interaction between a database auditor and potential attackers as a Stackelberg game in which the auditor chooses a (possibly randomized) auditing policy and attackers choose which, if any, records to target. Upon doing so, we show that even a highly constrained version of the auditing problem is NP-Hard. Based on this finding, we introduce an approach that combines linear programming, column generation, and heuristic search to derive an auditing policy. On the synthetic data, we perform an extensive evaluation on both the approximation degree of our solution with the optimal one and the computational magnitude of our approach. The two real datasets, 1) 1.5 months of audit logs from the electronic medical record system of Vanderbilt University Medical Center and 2) a publicly available credit card application dataset of 1000 records, are used to test the policy-searching performance. The findings illustrate that our methods produce high-quality mixed strategies as database audit policies, and our general approach significantly outperforms non-game-theoretic baselines. arXiv:1801.07215v1 [cs.AI]

show abstract

“…One of the proposed techniques works by defining preconditions and post-conditions and finding the causal relations of alerts, and then building the attack scenarios [8][9][10][11]. This technique is the most related to our own.…”

Section: Related Workmentioning

confidence: 99%

Boosting performance in attack intention recognition by integrating multiple techniques

Bai

Wang

et al. 2010

Front. Comput. Sci. China

View full text Add to dashboard Cite

Recognizing attack intention is crucial for security analysis. In recent years, a number of methods for attack intention recognition have been proposed. However, most of these techniques mainly focus on the alerts of an intrusion detection system and use algorithms of low efficiency that mine frequent attack patterns without reconstructing attack paths. In this paper, a novel and effective method is proposed, which integrates several techniques to identify attack intentions. Using this method, a Bayesian-based attack scenario is constructed, where frequent attack patterns are identified using an efficient data-mining algorithm based on frequent patterns. Subsequently, attack paths are rebuilt by recorrelating frequent attack patterns mined in the scenario. The experimental results demonstrate the capability of our method in rebuilding attack paths, recognizing attack intentions as well as in saving system resources. Specifically, to the best of our knowledge, the proposed method is the first to correlate complementary intrusion evidence with frequent pattern mining techniques based on the FP-Growth algorithm to rebuild attack paths and to recognize attack intentions.

show abstract

Alert Fusion Based on Cluster and Correlation Analysis

Cited by 18 publications

References 10 publications

Incident prioritisation using analytic hierarchy process (AHP): Risk Index Model (RIM)

Incident prioritisation using analytic hierarchy process (AHP): Risk Index Model (RIM)

Get Your Workload in Order: Game Theoretic Prioritization of Database Auditing

Boosting performance in attack intention recognition by integrating multiple techniques

Contact Info

Product

Resources

About