Discovering Coordinated Groups of IP Addresses Through Temporal Correlation of Alerts

Abstract

Network-based monitoring and intrusion detection systems generate a high number of alerts reporting on the suspicious activity of IP addresses. The majority of alerts are dropped due to their low relevance, low priority or due to the high number of alerts itself. We assume that these alerts still contain valuable information, namely, about the coordination of IP addresses. Knowledge of the coordinated IP addresses improves situational awareness and reflects the requirement of security analysts as well as automated reasoning tools to have as much contextual information as possible to make an informed decision. To validate our assumption, we introduce a novel method to discover the groups of coordinated IP addresses that exhibit a temporal correlation of their alerts. We evaluate our method on data from a real sharing platform reporting approximately 1.5 million alerts per day. The results show that our method can indeed discover groups of truly coordinated IP addresses.