Share on Facebook Tweet on Twitter Share on LinkedIn Share by email
A Novel Framework for Alert Correlation and Understanding

Dong Yu and Deborah Frincke

Abstract

We propose a novel framework named Hidden Colored Petri-Net for Alert Correlation and Understanding (HCPN-ACU) in intrusion detection system. This model is based upon the premise that intrusion detection may be viewed as an inference problem – in other words, we seek to show that system misusers are carrying out a sequence of steps to violate system security policies in some way, with earlier steps preparing for the later ones. In contrast with prior arts, we separate actions from observations and assume that the attackers actions themselves are unknown, but the attackers behavior may result in alerts. These alerts are then used to infer the attackers actions. We evaluate the model with DARPA evaluation database. We conclude that HCPN-ACU can conduct alert fusion and intention recognition at the same time, reduce false positives and negatives, and provide better understanding of the intrusion progress by introducing confidence scores.

Details

Publication typeInproceedings
Published inInternational Conference on Applied Cryptography and Network Security
PublisherSpringer Verlag
> Publications > A Novel Framework for Alert Correlation and Understanding