Abstract:Intrusion detection systems perform post-compromise detection of security breaches whenever preventive measures such as firewalls do not avert an attack. However, these systems raise a vast number of alerts that must be analysed and triaged by security analysts. This process is largely manual, tedious and time-consuming. Alert correlation is a technique that tries to reduce the number of intrusion alerts by aggregating those that are related in some way. However, the correlation is performed outside the IDS through third-party systems and tools, after the high volume of alerts has already been raised. These other third-party systems add to the complexity of security operations. In this paper, we build on the very researched area of correlation techniques by developing a novel hierarchical event correlation model that promises to reduce the number of alerts issued by an Intrusion Detection System. This is achieved by correlating the events before the IDS classifies them. The proposed model takes the best of features from similarity and graph-based correlation techniques to deliver an ensemble capability not possible by either approach separately. Further, we propose a correlation process for correlation of events rather than alerts as is the case in current art. We further develop our own correlation and clustering algorithm which is tailor-made to the correlation and clustering of network event data. The model is implemented as a proof of concept with experiments run on the DARPA 99 Intrusion detection set. The correlation achieved 87 percent data reduction through aggregation, producing nearly 21000 clusters in about 30 seconds.

Efficient Attack Correlation and Identification of Attack Scenarios based on Network-Motifs

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

Alert Correlation by A Retrospective Method

Real-Time Alert Stream Clustering and Correlation for Discovering Attack Strategies

Alert Correlation Through Results Tracing Back to Reasons

An Effective Attack Scenario Construction Model based on Attack Steps and Stages Identification

An Immune Inspired Network Intrusion Detection System Utilising Correlation Context

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Using Network Attack Graph to Predict the Future Attacks

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

An Algorithm of Alert Correlation Based on Address Correlation Graph in Distributed Intrusion Detection System

Scan Correlation -- Revealing distributed scan campaigns

A graph based system for multi-stage attacks recognition

Data Reduction in Intrusion Alert Correlation

Attack Graph Analysis for Network Anti-Forensics.

The Research of Alert Correlation Based on Attack Intetion

From Intrusion Detection to Attacker Attribution: A Comprehensive Survey of Unsupervised Methods

Real-Time Alert Correlation with Type Graphs

Application of Correlation Indices on Intrusion Detection Systems: Protecting the Power Grid Against Coordinated Attacks

Correlating Intrusion Alerts Into Attack Scenarios Based On Improved Evolving Self-Organizing Maps

Correlating intrusion alerts with Chi-square statistical profile