Fusing A Heterogeneous Alert Stream Into Scenarios

Advances in information securityPublished 1 January 2002

Oliver Dain, Robert K. Cunningham

Citations224

TL;DR

An algorithm for fusing the alerts produced by multiple heterogeneous intrusion detection systems is presented, which can determine the scenario membership of a new alert in time proportional to the number of candidate scenarios.

Abstract

An algorithm for fusing the alerts produced by multiple heterogeneous intrusion detection systems is presented. The algorithm runs in real-time, combining the alerts into scenarios; each is composed of a sequence of alerts produced by a single actor or organization. The software is capable of discovering scenarios even if stealthy attack methods, such as forged IP addresses or long attack latencies, are employed. The algorithm generates scenarios by estimating the probability that a new alert belongs to a given scenario. Alerts are then added to the most likely candidate scenario. Two alternative probability estimation techniques are compared to an algorithm that builds scenarios using a set of rules. Both probability estimate approaches make use of training data to learn the appropriate probability measures. Our algorithm can determine the scenario membership of a new alert in time proportional to the number of candidate scenarios.

Keywords

Computer Science

BiometricsClassification and Regression Trees.

23,841 Citations1984Alexander Gordon, Leo Breiman +3 more

Building Scenarios from a Heterogeneous Alert Stream

87 Citations2001Oliver Dain, Robert K. Cunningham

A realtime algorithm for combining the alerts produced by several heterogeneous intrusion detection sensors into scenarios that is capable of finding scenarios even if an intruder has used stealthy attack methods such as forged source IP addresses or long latencies between attack components.

Developing custom intrusion detection filters using data mining

73 Citations2002Chris Clifton, G. Gengo

This work is using data mining techniques to identify sequences of alarms that likely result from normal behavior, enabling construction of filters to eliminate those alarms from a particular environment.

Red Teaming of advanced information assurance concepts

45 Citations2002Bob Wood, Ruth A Duggan

The red team analysis process and the author's experiences applying this process to five selected Information Technology Office (ITO) projects are discussed.

LNKnet: Neural Network, Machine-Learning, and Statistical Software for Pattern Classification

35 Citations1993Richard P. Lippmann, Linda Kukolich +1 more

LNKnet is a software package that provides access to more than 20 patternclassification, clustering, and featureselection algorithms, including the most important algorithms from the fields of neural networks, statistics, machine learning, and artificial intelligence.

IEEE NetworkImproving the routing and addressing of IP

27 Citations1993Peter Ford, Yakov Rekhter +1 more

These proposals make it possible to significantly increase the utilization of addresses and extend the time the Internet can use the Internet Protocol (IP) Version 4.0.

Intrusion Detection

25 Citations1999Edward G. Amoroso

This book will lead you through the details and methodologies associated with this important type of security protection and anyone associated with information assurance for critical infrastructures will learn how intrusion detection can be applied to their unique security needs.

An Approach to Sensor Correlation

24 Citations2000Alfonso Valdes, Keith Skinner

The efficacy of the EMERALD alert thread mechanism, the sensor coupling in eBayes, and a prototype alert fusion capability towards achieving significant functionality in the field of ID sensor correlation.