Back close

Correlation of Alerts Using Prerequisites and Consequences for Intrusion Detection

Publication Type : Book Chapter

Thematic Areas : TIFAC-CORE in Cyber Security

Publisher : CIIT 2011

Source : Computational Intelligence and Information Technology (pp. 662-666). Springer Berlin Heidelberg.

Url : http://dx.doi.org/10.1007/978-3-642-25734-6_114

ISBN : 9783642257346

Keywords : Alert correlation, Alert Fusion, IDS

Campus : Coimbatore

School : School of Engineering, Centre for Cybersecurity Systems and Networks

Center : TIFAC CORE in Cyber Security

Department : cyber Security

Year : 2011

Abstract : pAlert Correlation is a process that analyses the alerts produced by one or more Intrusion Detection Sensors and provides a clear picture of occurring or attempted intrusions. Even though the correlation process is often presented as a single step, the analysis is actually carried out by a number of components, each of which has a specific goal. The idea of prerequisites of an intrusion, that is the necessary condition for the intrusion to be successful and the possible outcomes of intrusion is the consequences. This method also help us to correlates two alerts if the consequence of the earlier alert prepares for the prerequisites of the later one. In this system, before alert classification we are performing normalization, pre-processing, and alert correlation. In correlation phase there are two types of correlation, which are duplicate removal (alert fusion) and consequence correlation. Thus the resulting alert set is clustered. Based on this analysis of the alert set, the prioritization component assigns an appropriate priority to every alert. This priority information is important for quickly discarding information that is irrelevant or of less importance. The second way of prioritizing is based on the number of alerts coming from the networked systems./p

Cite this Research Publication : S. Mallissery, Praveen, K., and Sathar, S., “Correlation of Alerts Using Prerequisites and Consequences for Intrusion Detection”, in Computational Intelligence and Information Technology: First International Conference, CIIT 2011, Pune, India, November 7-8, 2011. Proceedings, V. V. Das and Thankachan, N., Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, pp. 662–666.

Admissions Apply Now