Sciweavers

Share
CN
2007

Improving the quality of alerts and predicting intruder's next goal with Hidden Colored Petri-Net

9 years 9 months ago
Improving the quality of alerts and predicting intruder's next goal with Hidden Colored Petri-Net
Intrusion detection systems (IDS) often provide poor quality alerts, which are insufficient to support rapid identification of ongoing attacks or predict an intruder’s next likely goal. In this paper, we propose a novel approach to alert postprocessing and correlation, the Hidden Colored Petri-Net (HCPN). Different from most other alert correlation methods, our approach treats the alert correlation problem as an inference problem rather than a filter problem. Our approach assumes that the intruder’s actions are unknown to the IDS and can be inferred only from the alerts generated by the IDS sensors. HCPN can describe the relationship between different steps carried out by intruders, model observations (alerts) and transitions (actions) separately, and associate each token element (system state) with a probability (or confidence). The model is an extension to Colored Petri-Net (CPN). It is so called ‘‘hidden’’ because the transitions (actions) are not directly observab...
Dong Yu, Deborah A. Frincke
Added 12 Dec 2010
Updated 12 Dec 2010
Type Journal
Year 2007
Where CN
Authors Dong Yu, Deborah A. Frincke
Comments (0)
books