Sciweavers

Share
ACNS
2004
Springer

A Novel Framework for Alert Correlation and Understanding

10 years 1 months ago
A Novel Framework for Alert Correlation and Understanding
Abstract. We propose a novel framework named Hidden Colored PetriNet for Alert Correlation and Understanding (HCPN-ACU) in intrusion detection system. This model is based upon the premise that intrusion detection may be viewed as an inference problem – in other words, we seek to show that system misusers are carrying out a sequence of steps to violate system security policies in some way, with earlier steps preparing for the later ones. In contrast with prior arts, we separate actions from observations and assume that the attacker’s actions themselves are unknown, but the attacker’s behavior may result in alerts. These alerts are then used to infer the attacker’s actions. We evaluate the model with DARPA evaluation database. We conclude that HCPN-ACU can conduct alert fusion and intention recognition at the same time, reduce false positives and negatives, and provide better understanding of the intrusion progress by introducing confidence scores.
Dong Yu, Deborah A. Frincke
Added 30 Jun 2010
Updated 30 Jun 2010
Type Conference
Year 2004
Where ACNS
Authors Dong Yu, Deborah A. Frincke
Comments (0)
books