Abstract:For the last years intrusion detection system(IDS) has been proved valuable in protecting computer systems against malicious attacks. It works by actively detecting abnormal activities and counter act,be it reporting to the user or taking certain actions automatically. The traditional IDS,however,is defective in that it deals with the detected abnormal activites only individually,bringing serious problems,classical ones of which include massively false alarms and massively repeated low-level alarms. An even more serious problem of the traditional IDS is that it is not effective,if not uselell,when the many individually detected abnormal activites are correlated components of a multi-step indepth intrusion,which is propably the case in nowadays since intrusions have evolved to be intelligent and distributive. To overcome this defect,this paper proposes a method called MSACA(multi-step attack correlating algorithm). As a prerequisite of the method,a knowledge database is provided. The knowledge database composes of the structures of known multi-step correlating attack,meaning that given certain low-level abnormal activites,through the database,we can get information regarding to what kinds of multi-step correlating attacks the given low-level alarms may be part of as well as to which stage they belong. The proposed method firstly gets the needed information of the low-level alarms from the database,secondly tries to form a big picture to reveal the possible threat of the low-level alarms working as a whole,and finally takes counter measures. The proposed method can be implemented in realtime scenarios. This paper also proves the proposed method's effectiveness by experiments.

The Research of Alert Correlation Based on Attack Intetion

An Algorithm of Alert Correlation Based on Address Correlation Graph in Distributed Intrusion Detection System

An alert correlating algorithm based on multi-step attack path graphs:MSACA

Survey of the Security Alerts Correlation Algorithms

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Intrusion Alerts Correlation Based Assessment of Network Security

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

Data Reduction in Intrusion Alert Correlation

Alert Correlation Algorithms: A Survey and Taxonomy

Industrial control network security situation awareness based on improved C-SVC

Efficient Attack Correlation and Identification of Attack Scenarios based on Network-Motifs

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

Real-Time Alert Correlation with Type Graphs

Towards High Level Attack Scenario Graph Through Honeynet Data Correlation Analysis

Research on Key Technologies of Network Security Situational Awareness for Attack Tracking Prediction

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey

Advanced Persistent Threat Group Correlation Analysis via Attack Behavior Patterns and Rough Sets

Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack

Alert reduction for network intrusion detection

Cyber Situation Comprehension For Iot Systems Based On Apt Alerts And Logs Correlation

CORRELATION ANALYSIS OF ATTACK STRATEGIESAND ROBUSTNESS ANALYSIS ON THREE NETWORK MODELS