Abstract:For the last years intrusion detection system(IDS) has been proved valuable in protecting computer systems against malicious attacks. It works by actively detecting abnormal activities and counter act,be it reporting to the user or taking certain actions automatically. The traditional IDS,however,is defective in that it deals with the detected abnormal activites only individually,bringing serious problems,classical ones of which include massively false alarms and massively repeated low-level alarms. An even more serious problem of the traditional IDS is that it is not effective,if not uselell,when the many individually detected abnormal activites are correlated components of a multi-step indepth intrusion,which is propably the case in nowadays since intrusions have evolved to be intelligent and distributive. To overcome this defect,this paper proposes a method called MSACA(multi-step attack correlating algorithm). As a prerequisite of the method,a knowledge database is provided. The knowledge database composes of the structures of known multi-step correlating attack,meaning that given certain low-level abnormal activites,through the database,we can get information regarding to what kinds of multi-step correlating attacks the given low-level alarms may be part of as well as to which stage they belong. The proposed method firstly gets the needed information of the low-level alarms from the database,secondly tries to form a big picture to reveal the possible threat of the low-level alarms working as a whole,and finally takes counter measures. The proposed method can be implemented in realtime scenarios. This paper also proves the proposed method's effectiveness by experiments.

Study of Intrusion Detection Based on Alarm Deviation Analysis

Study of Adaptive Intrusion Detection with Data Mining

An Intrusion Detection System Based On System Call

Intrusion Detection Research Based on Alarm Information of IDS

Real-time Detection of False Data Injection Attack Using Residual Prewhitening in Smart Grid Network.

Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

Parameter Determination and Performance Evaluation of Time-Series-based Leakage Detection Method

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Reduction on False Positive Rate of Anomaly IDS

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

Interference alarm identification method based on alarm duration feature

Alert reduction for network intrusion detection

Model Based Method for Reducing False Alarm Rate in Leak Detection

Discovering Anomaly on the Basis of Flow Estimation of Alert Feature Distribution

A Novel Data Mining-Based Method for Alert Reduction and Analysis.

Survey on Advanced Alarm Strategies Based on Multivariate Analysis

Research topics of intelligent alarm management

An alert correlating algorithm based on multi-step attack path graphs:MSACA

AR-Alarm: An Adaptive and Robust Intrusion Detection System Leveraging CSI from Commodity Wi-Fi

A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security

Design And Analysis Of Improved Alarm Delay-Timers