Effective and Efficient Intrusion Analysis

Oct 20, 2004

Abstract

Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there are intensive attacks, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. In this talk, I will present a series of techniques aimed at addressing this problem. These efforts start with an approach to constructing attack scenarios by correlating alerts on the basis of {em prerequisites} and {em consequences} of attacks. Intuitively, the prerequisite of an attack is the necessary condition for the attack to be successful, while the consequence of an attack is the possible outcome of the attack. Based on the prerequisites and consequences of different types of attacks, this method correlates alerts by (partially) matching the consequences of some prior alerts with the prerequisites of some later ones. In addition, I will present a method to automatically learn attack strategies from correlated alerts and to measure the similarity between sequences of attacks based on their strategies. Finally, I will talk about a recent approach we developed to hypothesize and reason about attacks potentially missed by IDSs.

Related website:
http://discovery.csc.ncsu.edu/Projects/AlertCorrelation