Real-time alert correlation with type graphs
The premise of automated alert correlation is to accept that false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which att...
| Main Authors: | , |
|---|---|
| Other Authors: | |
| Format: | Book Section |
| Published: |
Springer
2008
|
| Online Access: | https://eprints.nottingham.ac.uk/1285/ |
| _version_ | 1848790577262362624 |
|---|---|
| author | Tedesco, Gianni Aickelin, Uwe |
| author2 | Sekar, R |
| author_facet | Sekar, R Tedesco, Gianni Aickelin, Uwe |
| author_sort | Tedesco, Gianni |
| building | Nottingham Research Data Repository |
| collection | Online Access |
| description | The premise of automated alert correlation is to accept that
false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which attacks can be combined. These algorithms can be classified in to two broad categories namely scenario-graph approaches,
which create an attack model starting from a vulnerability assessment and type-graph approaches which rely on an abstract model of the relations between attack types. Some research in to improving the efficiency of type-graph correlation has been carried out but this research has ignored the hypothesizing of missing alerts. Our work is to present a novel type-graph algorithm which unifies correlation and hypothesizing in to a single operation. Our experimental results indicate that the approach is
extremely efficient in the face of intensive alerts and produces compact output graphs comparable to other techniques. |
| first_indexed | 2025-11-14T18:14:49Z |
| format | Book Section |
| id | nottingham-1285 |
| institution | University of Nottingham Malaysia Campus |
| institution_category | Local University |
| last_indexed | 2025-11-14T18:14:49Z |
| publishDate | 2008 |
| publisher | Springer |
| recordtype | eprints |
| repository_type | Digital Repository |
| spelling | nottingham-12852020-05-04T20:27:58Z https://eprints.nottingham.ac.uk/1285/ Real-time alert correlation with type graphs Tedesco, Gianni Aickelin, Uwe The premise of automated alert correlation is to accept that false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which attacks can be combined. These algorithms can be classified in to two broad categories namely scenario-graph approaches, which create an attack model starting from a vulnerability assessment and type-graph approaches which rely on an abstract model of the relations between attack types. Some research in to improving the efficiency of type-graph correlation has been carried out but this research has ignored the hypothesizing of missing alerts. Our work is to present a novel type-graph algorithm which unifies correlation and hypothesizing in to a single operation. Our experimental results indicate that the approach is extremely efficient in the face of intensive alerts and produces compact output graphs comparable to other techniques. Springer Sekar, R Pujari, Arun K. 2008 Book Section PeerReviewed Tedesco, Gianni and Aickelin, Uwe (2008) Real-time alert correlation with type graphs. In: Information systems security: 4th international conference, ICISS 2008, Hyderabad, India, December 16-20, 2008: proceedings /. Lecture notes in computer science (5352). Springer, Berlin, pp. 173-187. ISBN 9783540898627 http://www.springer.com/computer/communication+networks/book/978-3-540-89861-0 |
| spellingShingle | Tedesco, Gianni Aickelin, Uwe Real-time alert correlation with type graphs |
| title | Real-time alert correlation with type graphs |
| title_full | Real-time alert correlation with type graphs |
| title_fullStr | Real-time alert correlation with type graphs |
| title_full_unstemmed | Real-time alert correlation with type graphs |
| title_short | Real-time alert correlation with type graphs |
| title_sort | real-time alert correlation with type graphs |
| url | https://eprints.nottingham.ac.uk/1285/ https://eprints.nottingham.ac.uk/1285/ |