Recent Advances in Intrusion Detection

Volume 2516 of the series Lecture Notes in Computer Science pp 74-94


Analyzing Intensive Intrusion Alerts via Correlation

  • Peng NingAffiliated withDepartment of Computer Science, North Carolina State University
  • , Yun CuiAffiliated withDepartment of Computer Science, North Carolina State University
  • , Douglas S. ReevesAffiliated withDepartment of Computer Science, North Carolina State University

* Final gross prices may vary according to local VAT.

Get Access


Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there are intensive intrusions, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. Several complementary alert correlation methods have been proposed to address this problem. As one of these methods, we have developed a framework to correlate intrusion alerts using prerequisites of intrusions. In this paper, we continue this work to study the feasibility of this method in analyzing real-world, intensive intrusions. In particular, we develop three utilities (called adjustable graph reduction, focused analysis, and graph decomposition) to facilitate the analysis of large sets of correlated alerts. We study the effectiveness of the alert correlation method and these utilities through a case study with the network traffic captured at the DEF CON 8 Capture the Flag (CTF) event. Our results show that these utilities can simplify the analysis of large amounts of alerts, and also reveals several attack strategies that were repeatedly used in the DEF CON 8 CTF event.


Intrusion Detection Alert Correlation Attack Scenario Analysis