SRI Logo
About Us|R and D Divisions|Careers|Newsroom|Contact Us|SRI Home
     
  SRI Logo

Probabilistic Alert Correlation
 by Keith Skinner & Alfonso Valdes.

Lecture Notes in Computer Science, Number 2212.
From Recent Advances in Intrusion Detection (RAID 2001).
Springer-Verlag.
2001.


Abstract
With the growing deployment of host and network intrusion detection systems, managing reports from these systems becomes critically important. We present a probabilistic approach to alert correlation, extending ideas from multisensor data fusion. Features used for alert correlation are based on alert content that anticipates evolving IETF standards. The probabilistic approach provides a unified mathematical framework for correlating alerts that match closely but not perfectly, where the minimum degree of match required to fuse alerts is controlled by a single configurable parameter. Only features in common are considered in the fusion algorithm. For each feature we define an appropriate similarity function. The overall similarity is weighted by a specifiable expectation of similarity. In addition, a minimum similarity may be specified for some or all features. Features in this set must match at least as well as the minimum similarity specification in order to combine alerts, regardless of the goodness of match on the feature set as a whole. Our approach correlates attacks over time, correlates reports from heterogeneous sensors, and correlates multiple attack steps.
BibTEX Entry
@inproceedings{raid2001-pac,
    AUTHOR = {Alfonso Valdes and Keith Skinner},
    TITLE = {Probabilistic Alert Correlation},
    BOOKTITLE = {Recent Advances in Intrusion Detection (RAID 2001)},
    YEAR = {2001},
    SERIES = {Lecture Notes in Computer Science},
    NUMBER = {2212},
    PUBLISHER = {Springer-Verlag},
    URL = {http://www.sdl.sri.com/papers/raid2001-pac/},
    KEYWORDS = {Network security, sensor correlation, alert management,adaptive systems}
}
Files
 













 

About Us  |  R&D Divisions  |  Careers  |  Newsroom  |  Contact Us
© 2017 SRI International 333 Ravenswood Avenue, Menlo Park, CA 94025-3493
SRI International is an independent, nonprofit corporation. Privacy policy