Abstract:Intrusion detection systems (IDSs) generate valuable knowledge about network security, but an abundance of false alarms and a lack of methods to capture the interdependence among alerts hampers their utility for network defense. Here, we explore a graph-based approach for fusing alerts generated by multiple IDSs (e.g., Snort, OSSEC, and Bro). Our approach generates a weighted graph of alert fields (not network topology) that makes explicit the connections between multiple alerts, IDS systems, and other cyber artifacts. We use this multi-modal graph to identify anomalous changes in the alert patterns of a network. To detect the anomalies, we apply the role-dynamics approach, which has successfully identified anomalies in social media, email, and IP communication graphs. In the cyber domain, each node (alert field) in the fused IDS alert graph is assigned a probability distribution across a small set of roles based on that node's features. A cyber attack should trigger IDS alerts and cause changes in the node features, but rather than track every feature for every alert-field node individually, roles provide a succinct, integrated summary of those feature changes. We measure changes in each node's probabilistic role assignment over time, and identify anomalies as deviations from expected roles. We test our approach using simulations including three weeks of normal background traffic, as well as cyber attacks that occur near the end of the simulations. This paper presents a novel approach to multi-modal data fusion and a novel application of role dynamics within the cyber-security domain. Our results show a drastic decrease in the false-positive rate when considering our anomaly indicator instead of the IDS alerts themselves, thereby reducing alarm fatigue and providing a promising avenue for threat intelligence in network defense.

Stateful Security Alert Correlation by Dynamic Bayesian Plan Graph

State security alert correlation by dynamic Bayesian plan graph

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

Dynamic Network Security Analysis Based on Bayesian Attack Graphs

An alert correlating algorithm based on multi-step attack path graphs:MSACA

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Proactive Security Defense of Dynamic Network

Real-Time Alert Correlation with Type Graphs

Survey of the Security Alerts Correlation Algorithms

A Network Attack Plan Recognition Algorithm Based on the Extended Goal Graph

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

Dynamic Graph Neural Networks-Based Alert Link Prediction for Online Service Systems

Process Monitoring Based On Multivariate Causality Analysis And Probability Inference

The Research of Alert Correlation Based on Attack Intetion

An Algorithm of Alert Correlation Based on Address Correlation Graph in Distributed Intrusion Detection System

Dynamic risk analysis with alarm data to improve process safety using Bayesian network

Intrusion Alerts Correlation Based Assessment of Network Security

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

Computer network security evaluation method based on improved attack graph

Cyber Anomaly Detection Using Graph-node Role-dynamics

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events