On the alert correlation process for the detection of multi-step attacks and a graph-based realization
| Autor: | Mathias Fischer, Steffen Haas |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
Honeypot
Computer science Alert correlation Process (computing) 020206 networking & telecommunications Ocean Engineering 02 engineering and technology Intrusion detection system Computer security computer.software_genre Face (geometry) 0202 electrical engineering electronic engineering information engineering False positive paradox Graph (abstract data type) 020201 artificial intelligence & image processing computer Realization (probability) |
| Zdroj: | ACM SIGAPP Applied Computing Review. 19:5-19 |
| ISSN: | 1931-0161 1559-6915 |
| DOI: | 10.1145/3325061.3325062 |
| Popis: | Monitoring tools like Intrusion Detection Systems (IDS), Firewalls, or Honeypots are a second line of defense in the face of an increasing number of distributed, increasingly sophisticated, and targeted attacks. A huge amount of security alerts needs to be analyzed and correlated to gather the complete picture of an attack. However, most conventional IDS fall short in correlating alerts that have different sources, so that many distributed attacks remain completely unnoticed. In this paper, we define alert correlation as a process and describe the consecutive steps along with their properties and goals. Following this process, we propose Graph-based Alert Correlation (GAC), a novel correlation algorithm that isolates attacks, identifies attack scenarios, and assembles multi-stage attacks from huge alert sets. Our evaluation results on artificial and real-world data indicates that GAC is robust against false positives, can detect distributed attacks, and scales with an increasing number of alerts. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|