Integrating IDS Alert Correlation and OS-Level Dependency Tracking

  • Yan Zhai
  • Peng Ning
  • Jun Xu
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3975)


Intrusion alert correlation techniques correlate alerts into meaningful groups or attack scenarios for the ease to understand by human analysts. However, the performance of correlation is undermined by the imperfectness of intrusion detection techniques. Falsely correlated alerts can be misleading to analysis. This paper presents a practical technique to improve alert correlation by integrating alert correlation techniques with OS-level object dependency tracking. With the support of more detailed and precise information from OS-level event logs, higher accuracy in alert correlation can be achieved. The paper also discusses the application of such integration in improving the accuracy of hypotheses about possibly missed attacks while reducing the complexity of the hypothesizing process. A series of experiments are performed to evaluate the effectiveness of the methods, and the results demonstrate significant improvements on correlation results with the proposed techniques.


Intrusion Detection Dependency Graph Attack Scenario Consequence Object Correlation Graph 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
  2. 2.
    Ammann, P., Wijesekera, D., Kaushik, S.: Scalable, graph-based network vulnerability analysis. In: Proceedings of the 9th ACM CCS (2002)Google Scholar
  3. 3.
    Cuppens, F.: Managing alerts in a multi-intrusion detection environment. In: Proceedings of the 17th Annual Computer Security Applications Conference (December 2001)Google Scholar
  4. 4.
    Cuppens, F., Miege, A.: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy (May 2002)Google Scholar
  5. 5.
    Dain, O., Cunningham, R.: Building scenarios from a heterogeneous alert stream. In: Proceedings of the 2001 IEEE Workshop on Information Assurance and Security (June 2001)Google Scholar
  6. 6.
    Dain, O., Cunningham, R.: Fusing a heterogeneous alert stream into scenarios. In: Proceedings of the 2001 ACM Workshop on Data Mining for Security Applications (November 2001)Google Scholar
  7. 7.
    Debar, H., Wespi, A.: Aggregation and correlation of intrusion-detection alerts. In: Lee, W., Mé, L., Wespi, A. (eds.) RAID 2001. LNCS, vol. 2212, pp. 85–103. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  8. 8.
    King, S., Chen, P.: Backtracking intrusions. In: Proceedings of the 2003 Symposium on Operating Systems Principles (SOSP) (October 2003)Google Scholar
  9. 9.
    King, S., Mao, Z., Lucchetti, D., Chen, P.: Enriching intrusion alerts through multi-host causality. In: Proceedings of the 12th NDSS (2005)Google Scholar
  10. 10.
    Morin, B., Mé, L., Debar, H., Ducassé, M.: M2D2: a formal data model for IDS alert correlation. In: Proceedings of RAID 2002 (2002)Google Scholar
  11. 11.
    Ning, P., Cui, Y., Reeves, D.S.: Constructing attack scenarios through correlation of intrusion alerts. In: Proceedings of the 9th ACM CCS (2002)Google Scholar
  12. 12.
    Ning, P., Xu, D., Healey, C., Amant, R.S.: Building attack scenarios through integration of complementary alert correlation methods. In: Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS 2004), February 2004, pp. 97–111 (2004)Google Scholar
  13. 13.
    Porras, P.A., Fong, M.W., Valdes, A.: A mission-impact-based approach to INFOSEC alarm correlation. In: Wespi, A., Vigna, G., Deri, L. (eds.) RAID 2002. LNCS, vol. 2516, p. 95. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  14. 14.
    Templeton, S., Levitt, K.: A requires/provides model for computer attacks. In: Proceedings of New Security Paradigms Workshop, pp. 31–38. ACM Press, New York (2000)CrossRefGoogle Scholar
  15. 15.
    Valdes, A., Skinner, K.: Probabilistic alert correlation. In: Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection, pp. 54–68 (2001)Google Scholar
  16. 16.
    Zhai, Y., Ning, P., Iyer, P., Reeves, D.: Reasoning about complementary intrusion evidence. In: Proceedings of the 20th Annual Computer Security Applications Conference (December 2004)Google Scholar
  17. 17.
    Zhai, Y., Ning, P., Xu, J.: Integrating IDS alert correlation and OS-level depdendency tracking. Technical Report TR-2005-27, Department of Computer Science, North Carolina State University (2005)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Yan Zhai
    • 1
  • Peng Ning
    • 1
  • Jun Xu
    • 1
  1. 1.North Carolina State University 

Personalised recommendations