Abstract:Intrusion detection systems (IDSs) generate valuable knowledge about network security, but an abundance of false alarms and a lack of methods to capture the interdependence among alerts hampers their utility for network defense. Here, we explore a graph-based approach for fusing alerts generated by multiple IDSs (e.g., Snort, OSSEC, and Bro). Our approach generates a weighted graph of alert fields (not network topology) that makes explicit the connections between multiple alerts, IDS systems, and other cyber artifacts. We use this multi-modal graph to identify anomalous changes in the alert patterns of a network. To detect the anomalies, we apply the role-dynamics approach, which has successfully identified anomalies in social media, email, and IP communication graphs. In the cyber domain, each node (alert field) in the fused IDS alert graph is assigned a probability distribution across a small set of roles based on that node's features. A cyber attack should trigger IDS alerts and cause changes in the node features, but rather than track every feature for every alert-field node individually, roles provide a succinct, integrated summary of those feature changes. We measure changes in each node's probabilistic role assignment over time, and identify anomalies as deviations from expected roles. We test our approach using simulations including three weeks of normal background traffic, as well as cyber attacks that occur near the end of the simulations. This paper presents a novel approach to multi-modal data fusion and a novel application of role dynamics within the cyber-security domain. Our results show a drastic decrease in the false-positive rate when considering our anomaly indicator instead of the IDS alerts themselves, thereby reducing alarm fatigue and providing a promising avenue for threat intelligence in network defense.

Anomaly Detection and Identification for Multiagent Systems Subjected to Physical Faults and Cyberattacks

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Multi-agent based hybrid Intrusion detection system

An Anomaly Detection and Scenario Classification Scheme Based on Fuzzy C-means Clustering

Physical Safety and Cyber Security Analysis of Multi-Agent Systems: A Survey of Recent Advances

Event-triggered Distributed Attack Detection and Fault Diagnosis

A Trust Management and Misbehaviour Detection Mechanism for Multi-Agent Systems and its Application to Intelligent Transportation Systems

Data-driven fault detection of heterogeneous multi-agent systems using combined hardware and temporal redundant information

Anomaly Identification for Cyber-Physical Systems Subject to Replay Attacks and Sensor Faults

A Data-Driven Subspace Distributed Fault Detection Strategy for Linear Heterogeneous Multi-Agent Systems

Conflict-driven Hybrid Observer-based Anomaly Detection

Distributed Fault Detection For Formation Of Multi-Agent Systems

An Intelligent Security System Using Enhanced Anomaly-Based Detection Scheme

On Distinguishability of Anomalies as Physical Faults or Actuation Cyberattacks

Cyberattack Detection for a Class of Nonlinear Multiagent Systems Using Set-Membership Fuzzy Filtering

Cyber-Attack Detection in Discrete Nonlinear Multi-Agent Systems Using Neural Networks

Cyberattack Detection for Nonlinear Leader-Following Multi-Agent Systems Using Set-Membership Fuzzy Filtering

Cyber Anomaly Detection Using Graph-node Role-dynamics

Anomaly Detection from Cyber Threats via Infrastructure to Automated Vehicle

Anomaly recognition method of perception system for autonomous vehicles based on distance metric

Robust Distributed Sensor Fault Detection and Diagnosis Within Formation Control of Multiagent Systems.