Multistep Attack Detection and Alert Correlation in Intrusion Detection Systems

  • Fabio Manganiello
  • Mirco Marchetti
  • Michele Colajanni
Part of the Communications in Computer and Information Science book series (CCIS, volume 200)


A growing trend in the cybersecurity landscape is represented by multistep attacks that involve multiple correlated intrusion activities to reach the intended target. The duty of reconstructing complete attack scenarios is left to system administrators because current Network Intrusion Detection Systems (NIDS) are still oriented to generate alerts related to single attacks, with no or minimal correlation.

We propose a novel approach for the automatic analysis of multiple security alerts generated by state-of-the-art signature-based NIDS. Our proposal is able to group security alerts that are likely to belong to the same attack scenario, and to identify correlations and causal relationships among them. This goal is achieved by combining alert classification through Self Organizing Maps and unsupervised clustering algorithms. The efficacy of the proposal is demonstrated through a prototype tested against network traffic traces containing multistep attacks.


Network security neural networks alert correlation 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Chen, Z.G., Zhang, G.H., Tian, L.Q., Geng, Z.L.: Intrusion detection based on self-organizing map and artificial immunisation algorithm. Engineering Materials 439(1), 29–34 (2010)Google Scholar
  2. 2.
    Colajanni, M., Marchetti, M., Messori, M.: Selective and early threat detection in large networked systems. In: Proc. of the 10th IEEE International Conference on Computer and Information Technology, CIT 2010 (2010)Google Scholar
  3. 3.
    Capture the flag traffic dump,
  4. 4.
    Julisch, K.: Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security 6, 443–471 (2003)CrossRefGoogle Scholar
  5. 5.
    Kohonen, T.: The self-organizing map, vol. 78(9) (1990)Google Scholar
  6. 6.
    Mukkamala, S., Janoski, G., Sung, A.: Intrusion detection using neural networks and support vector machines. In: Proceedings of the 2002 International Joint Conference on Neural Networks (2002)Google Scholar
  7. 7.
    Munesh, K., Shoaib, S., Humera, N.: Feature-based alert correlation in security systems using self organizing maps. In: Proceedings of SPIE, the International Society for Optical Engineering (2009)Google Scholar
  8. 8.
    Patole, V.A., Pachghare, V.K., Kulkarni, P.: Article: Self organizing maps to build intrusion detection system. International Journal of Computer Applications 1(7), 1–4 (2010)CrossRefGoogle Scholar
  9. 9.
    Pelleg, D., Moore, A.: X-means: Extending k-means with efficient estimation of the number of clusters. In: Proc. of the 17th International Conference on Machine Learning, pp. 727–734. Morgan Kaufmann, San Francisco (2000)Google Scholar
  10. 10.
    Snort home page,
  11. 11.
    Su, M.C., Liu, T.K., Chang, H.T.: Improving the self-organizing feature map algorithm using an efficient initialization scheme. Tamkang Journal of Science and Engineering 5(1), 35–48 (2002)Google Scholar
  12. 12.
    Valeur, F., Vigna, G., Kruegel, C., Kemmerer, R.A.: A comprehensive approach to intrusion detection alert correlation. IEEE Transactions on Dependable and Secure Computing 1, 146–169 (2004)CrossRefGoogle Scholar
  13. 13.
    Vokorokos, L., Baláz, A., Chovanec, M.: Intrusion detection system using self organizing map, vol. 6(1) (2006)Google Scholar
  14. 14.
    Yoo, J.H., Kang, B.H., Kim, J.W.: A clustering analysis and learning rate for self-organizing feature map. In: Proc. of the 3rd International Conference on Fuzzy Logic, Neural Networks and Soft Computing (1994)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Fabio Manganiello
    • 1
  • Mirco Marchetti
    • 1
  • Michele Colajanni
    • 1
  1. 1.Department of Information EngineeringUniversità degli Studi di Modena e Reggio EmiliaModenaItaly

Personalised recommendations