Abstract:The exponential expansion of Internet interconnectivity has led to a dramatic increase in cyber-attack alerts, which contain a considerable proportion of false positives. The overwhelming number of false positives cause tremendous resource consumption and delay responses to the really severe incidents, namely, alert fatigue. To cope with the challenge from alert fatigue, we focus on enhancing the capability of detectors to reduce the generation of false alerts from the detection perspective. The core idea of our work is to train a machine-learning-based detector to grasp the empirical intelligence of security analysts to estimate the feasibility of an incoming HTTP request to cause substantial threats, and integrate the estimation into the detection stage to reduce false alarms. To this end, we innovatively introduce the concept of attack feasibility to characterize the composition rationality of an inbound HTTP request as a feasible attack under static scrutinization. First, we adopt a fast request-reorganization algorithm to transform an HTTP request into the form of interface:payload pair for further alignment of structural components which can reveal the processing logic of the target program. Then, we build a dual-channel attention-based circulant convolution neural network (DualAC2NN) to integrate the attack feasibility estimation into the alert decision, by comprehensively considering the interface sensitivity, payload maliciousness, and their bipartite compatibility. Experiments on a real-world dataset show that the proposed method significantly reduces invalid alerts by around 86.37% and over 61.64% compared to a rule-based commercial WAF and several state-of-the-art methods, along with retaining a detection rate at 97.89% and a lower time overhead, which indicates that our approach can effectively mitigate alert fatigue from the detection perspective.

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

An alert correlating algorithm based on multi-step attack path graphs:MSACA

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models

Deceptive attack detection of control system using multi-scale principal component analysis

Anomaly based multi-stage attack detection method

Intrusion Alerts Correlation Based Assessment of Network Security

DualAC2NN: Revisiting and Alleviating Alert Fatigue from the Detection Perspective

An Unsupervised Two-Layer Multi-Step Network Attack Detector

The Research of Alert Correlation Based on Attack Intetion

Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack

A Scalable and Efficient Correlation Engine to Detect Multi-Step Attacks in Distributed Systems

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

Coordinated Web Scan Detection Based on Hierarchical Correlation

Introducing a New Alert Data Set for Multi-Step Attack Analysis

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

<sc>Poirot</sc>: Causal Correlation Aided Semantic Analysis for Advanced Persistent Threat Detection

An Algorithm of Alert Correlation Based on Address Correlation Graph in Distributed Intrusion Detection System

Cyber Situation Comprehension For Iot Systems Based On Apt Alerts And Logs Correlation

Survey of the Security Alerts Correlation Algorithms