Skip to main content

Research Repository

Advanced Search

Data Reduction in Intrusion Alert Correlation

Tedesco, Gianni; Aickelin, Uwe

Authors

Gianni Tedesco

Uwe Aickelin



Abstract

Network intrusion detection sensors are usually built around low level models of network traffic. This means that their output is of a similarly low level and as a consequence, is difficult to analyze. Intrusion alert correlation is the task of automating some of this analysis by grouping related alerts together. Attack graphs provide an intuitive model for such analysis. Unfortunately alert flooding attacks can still cause a loss of service on sensors, and when performing attack graph correlation, there can be a large number of extraneous alerts included in the output graph. This obscures the fine structure of genuine attacks and makes them more difficult for human operators to discern. This paper explores modified correlation algorithms which attempt to minimize the impact of this attack.

Citation

Tedesco, G., & Aickelin, U. (2006). Data Reduction in Intrusion Alert Correlation. WSEAS Transactions on Computers,

Journal Article Type Article
Publication Date Jan 1, 2006
Deposit Date Mar 31, 2006
Publicly Available Date Oct 9, 2007
Journal WSEAS Transactions on Computers
Print ISSN 1109-2750
Publisher World Scientific and Engineering Academy and Society
Peer Reviewed Peer Reviewed
Keywords Intrusion Detection Systems, Alert Correlation, Attack Graphs, Denial of Service Attacks, Token Bucket Filter
Public URL http://eprints.nottingham.ac.uk/id/eprint/365

Files





You might also like



Downloadable Citations