Abstract:For the last years intrusion detection system(IDS) has been proved valuable in protecting computer systems against malicious attacks. It works by actively detecting abnormal activities and counter act,be it reporting to the user or taking certain actions automatically. The traditional IDS,however,is defective in that it deals with the detected abnormal activites only individually,bringing serious problems,classical ones of which include massively false alarms and massively repeated low-level alarms. An even more serious problem of the traditional IDS is that it is not effective,if not uselell,when the many individually detected abnormal activites are correlated components of a multi-step indepth intrusion,which is propably the case in nowadays since intrusions have evolved to be intelligent and distributive. To overcome this defect,this paper proposes a method called MSACA(multi-step attack correlating algorithm). As a prerequisite of the method,a knowledge database is provided. The knowledge database composes of the structures of known multi-step correlating attack,meaning that given certain low-level abnormal activites,through the database,we can get information regarding to what kinds of multi-step correlating attacks the given low-level alarms may be part of as well as to which stage they belong. The proposed method firstly gets the needed information of the low-level alarms from the database,secondly tries to form a big picture to reveal the possible threat of the low-level alarms working as a whole,and finally takes counter measures. The proposed method can be implemented in realtime scenarios. This paper also proves the proposed method's effectiveness by experiments.

An Algorithm of Alert Correlation Based on Address Correlation Graph in Distributed Intrusion Detection System

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

An alert correlating algorithm based on multi-step attack path graphs:MSACA

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Data Reduction in Intrusion Alert Correlation

Study on adaptive trust alert correlation P2P overlay IDS

The Research of Alert Correlation Based on Attack Intetion

Alert Correlation Algorithms: A Survey and Taxonomy

Survey of the Security Alerts Correlation Algorithms

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

Efficient Attack Correlation and Identification of Attack Scenarios based on Network-Motifs

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

Real-Time Alert Correlation with Type Graphs

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

A Distributed Anomaly Detection Scheme Based on Correlation Awareness in WSN

Intrusion Alerts Correlation Based Assessment of Network Security

Coordinated Web Scan Detection Based on Hierarchical Correlation

Application of Correlation Indices on Intrusion Detection Systems: Protecting the Power Grid Against Coordinated Attacks

Towards Scalable and Robust Distributed Intrusion Alert Fusion with Good Load Balancing.

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling