Integrating security operator knowledge and preferences to the alert correlation process

Abstract

Intrusion Detection Systems (IDS) are necessary for the system monitoring. However they produce a huge quantity of alerts. Alert correlation is a process applied to the IDS alerts in order to reduce their number. In this paper we propose a new approach for alert correlation which enables the integration of new information to the alert correlation process: Security operator's knowledge and preferences. This information concerns the monitoring system and the risk level of each alert in according for instance to the operator's experiences. The representation and the reasoning on these knowledge and preferences are done using the Qualitative Choice Logic (QCL) and its extensions: Prioritized Qualitative Choice Logic (PQCL) and Positive Qualitative Choice Logic (QCL+). Experimental results are achieved on data from a real system monitoring. The result is a set of ordered alerts which satisfies operator's criteria.

Contextual‐based approach to reduce false positives

“…Bouzar-Benlabiod et al [30] integrates security operator knowledge and preferences to alerts correlation process using qualitative choice logic…”

A Comparative Study of Alert Correlations for Intrusion Detection

“…This approach uses explicit correlation and its objective is to detect complex attack scenarios [21]. The learning process either supervised or unsupervised is involved.…”

“…The main advantage for this method is that it is able to accurately to detect well-documented attacks derived from the libraries. But if it is a novel attack, the method will fail to detect the intrusion [5,20,21]. The main concern of this approach is the need of more complete and comprehensive scenario libraries, time and cost to build and maintain them are main concerns.…”