Mining security events in a distributed agent society

Abstract

In distributed agent architecture, tasks are performed on multiple computers which are sometimes spread across different locations. While it is important to collect security critical sensory information from the agent society, it is equally important to analyze and report such security events in a precise and useful manner. Data mining techniques are found to be very efficient in the generation of security event profiles. This paper describes the implementation of such a security alert mining tool which generates profiles of security events collected from a large agent society. In particular, our previous work addressed the development of a security console to collect and display alert message (IDMEF) from a Cougaar (agent) society. These messages are then logged in an XML database for further off-line analysis. In our current work, stream mining algorithms are applied for sequencing and generating frequently occurring episodes, and then finding association rules among frequent candidate episodes. This alert miner could profile most prevalent patterns as indications of frequent attacks in a large agent society.

On the Sequential Pattern and Rule Mining in the Analysis of Cyber Security Alerts

“…Time window size and support values are discussed and the approaches are evaluated using DARPA 1998 dataset. Dasgupta et al [4] used frequent episode mining to analyze security alerts from DARPA 2000 dataset. Some limitations, e.g., minimal confidence and maximal episode length, are mentioned, but the data mining component is otherwise described very briefly as a part of a larger system.…”

“…In total, we got 16 million security alerts. The alerts are formatted in IDEA 4 , an extensible data exchange format inspired by IDMEF and suited for the needs of SABU platform. Each alert contains at least a timestamp and a category of a reported event.…”

Cooperation modeling for intrusion detection system based on Multi-SoftMan

“…Therefore, based on the SoftMan theory, we have constructed a cooperation control model for intrusion detection system based on multi-SoftMan alliance (MSMIDS) [7]. This system model is adopted distributed architecture [8,9] 2) Data collection SoftMan (DCSM) is a special SoftMan for collection data. DCSM may be located in a detected Host or Server.…”