Skip to Main content Skip to Navigation
Journal articles

Alert correlation: Severe attack prediction and controlling false alarm rate tradeoffs

Abstract : Alert correlation plays an increasingly crucial role in nowadays computer security infrastructures. It is particularly needed for coping with the huge amounts of alerts which are daily triggered by intrusion detection systems (IDSs), fire-walls, etc. While the use of multiple IDSs, security tools and complementary approaches is fundamental and highly recommended in order to improve the overall detection rates, this however inevitably causes huge amounts of alerts most of which are redundant and false alarms making the manual analysis of these triggered alerts time-consuming and inefficient. This paper addresses three important issues related to predicting severe attacks (attacks with high dangerousness levels) by analyzing inoffensive and preparatory attacks. i) Firstly, we address the issue of preprocessing alerts reported by the multiple detection tools in order to eliminate the redundant and irrelevant alerts and format them so that they can be analyzed by a severe attack prediction model. ii)Then, we propose a novel prediction model based on a Bayesian network multi-net allowing on one hand to better model the severe attacks and on the other hand handle the reliability of IDSs when predicting severe attacks. iii) Finally, we provide a flexible and efficient approach especially designed to limit the false alarm rates by controlling the confidence of the prediction model. The main benefits of our approach is an integrated model guaranteeing very promising prediction/false alarm rate tradeoffs with minimum expert intervention. Our experimental studies are carried out on a real and representative alert corpus generated by the de facto network-based IDS Snort, and show very interesting performances regarding the tradeoffs between the prediction rates and the corresponding false alarm ones.
Document type :
Journal articles
Complete list of metadata

Cited literature [37 references]  Display  Hide  Download

https://hal.archives-ouvertes.fr/hal-00568027
Contributor : Philippe Leray Connect in order to contact the contributor
Submitted on : Friday, April 17, 2020 - 10:19:55 PM
Last modification on : Wednesday, April 27, 2022 - 3:42:21 AM

File

ida.pdf
Files produced by the author(s)

Identifiers

Citation

Karim Tabia, Philippe Leray. Alert correlation: Severe attack prediction and controlling false alarm rate tradeoffs. Intelligent Data Analysis, IOS Press, 2011, 15 (6), pp.?-?. ⟨10.3233/IDA-2011-0504⟩. ⟨hal-00568027⟩

Share

Metrics

Record views

63

Files downloads

121