HAL will be down for maintenance from Friday, June 10 at 4pm through Monday, June 13 at 9am. More information
Skip to Main content Skip to Navigation
Journal articles

A logic-based model to support alert correlation in intrusion detection

Abstract : Managing and supervising security in large networks has become a challenging task, as new threats and flaws are being discovered on a daily basis. This requires an in depth and up-to-date knowledge of the context in which security-related events occur. Several tools have been proposed to support security operators in this task, each of which focuses on some specific aspects of the monitoring. Many alarm fusion and correlation approaches have also been investigated. However, most of these approaches suffer from two major drawbacks. First, they only take advantage of the information found in alerts, which is not sufficient to achieve the goals of alert correlation, that is to say to reduce the overall amount of alerts, while enhancing their semantics. Second, these techniques have been designed on an ad hoc basis and lack a shared data model that would allow them to reason about events in a cooperative way. In this paper, we propose a federative data model for security systems to query and assert knowledge about security incidents and the context in which they occur. This model constitutes a consistent and formal ground to represent information that is required to reason about complementary evidences, in order to confirm or invalidate alerts raised by intrusion detection systems.
Document type :
Journal articles
Complete list of metadata

Contributor : Myriam Andrieux Connect in order to contact the contributor
Submitted on : Wednesday, January 14, 2009 - 3:35:17 PM
Last modification on : Tuesday, October 19, 2021 - 11:58:50 PM



Benjamin Morin, Ludovic Mé, Hervé Debar, Mireille Ducassé. A logic-based model to support alert correlation in intrusion detection. Information Fusion, Elsevier, 2009, 10 (4), pp.285-299. ⟨10.1016/j.inffus.2009.01.005⟩. ⟨hal-00353059⟩



Record views