Constructing attack scenarios through correlation of intrusion alerts

Abstract

Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there are intensive attacks, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. This paper presents a practical technique to address this issue. The proposed approach constructs attack scenarios by correlating alerts on the basis of prerequisites and consequences of attacks. Intuitively, the prerequisite of an attack is the necessary condition for the attack to be successful, while the consequence of an attack is the possible outcome of the attack. Based on the prerequisites and consequences of different types of attacks, our method correlates alerts by (partially) matching the consequences of some prior alerts with the prerequisites of some later ones. Moreover, to handle large collections of alerts, this paper presents three interactive analysis utilities aimed at reducing the complexity of the constructed attack scenarios without losing the structure of the attacks. This paper also reports the experiments conducted to validate the proposed techniques with the 2000 DARPA intrusion detection scenario-specific datasets, and the data collected at the DEFCON 8 Capture The Flag (CTF) event.

A Collaborative Approach to Botnet Protection

“…The general approach for correlating aspects of behaviour observed by various sensors is based on ideas presented by Strayer et al [27], Oliner et al [17] and Flaglien et al [4], which extend older proposals made by Cuppens & Miège [3] and Ning et al [16] for correlation of alerts in IDS systems. Using these or similar concepts, several authors have proposed botnet detection systems that correlate alerts from several detection entities.…”

Secure Configuration of Intrusion Detection Sensors for Changing Enterprise Systems

“…Schemes in this area can be classified under two basic groups: schemes that require patterns of actual attacks and/or alert interdependencies, and schemes that do not. Members of the first group include [11], [12], and [13]. Our proposed framework, can be classified as part of the first group.…”

“…In [11], the authors present a formal framework for alert correlation that constructs attack graphs by correlating individual alerts on the basis of the prerequisites and consequences manually associated to each alert. [12] presents techniques to learn attack strategies from correlated attack graphs.…”

A Cognitive Model for Alert Correlation in a Distributed Environment

“…This work outlines a semi-automatic approach for reducing false positives in alarms by identifying the root causes with clustering of alerts by abstraction and then eliminating the root causes to reduce alarm overload. Ning et al proposes an alert correlation model based on prerequisites and consequences of intrusion [8]. With knowledge of prerequisites and consequences, the correlation model can correlate related alerts by matching the consequences of previous alerts with prerequisites of later ones and then hyper alert correlation graphs are used to represent the alerts.…”

“…Fig. 2 is an FCM that models the scenario described above for the DDoS attack using cause and effect types of events (the EEvents shown here are similar to the consequences of hyper alert types as in [8]). The FCM in this figure denotes that an IPSweep alert in the sensor report will generate an IPSweep CEvent, from which HostExits EEvent can be inferred.…”