Multistep Attack Detection and Alert Correlation in Intrusion Detection Systems
A growing trend in the cybersecurity landscape is represented by multistep attacks that involve multiple correlated intrusion activities to reach the intended target. The duty of reconstructing complete attack scenarios is left to system administrators because current Network Intrusion Detection Systems (NIDS) are still oriented to generate alerts related to single attacks, with no or minimal correlation.
We propose a novel approach for the automatic analysis of multiple security alerts generated by state-of-the-art signature-based NIDS. Our proposal is able to group security alerts that are likely to belong to the same attack scenario, and to identify correlations and causal relationships among them. This goal is achieved by combining alert classification through Self Organizing Maps and unsupervised clustering algorithms. The efficacy of the proposal is demonstrated through a prototype tested against network traffic traces containing multistep attacks.
KeywordsNetwork security neural networks alert correlation
Unable to display preview. Download preview PDF.
- 1.Chen, Z.G., Zhang, G.H., Tian, L.Q., Geng, Z.L.: Intrusion detection based on self-organizing map and artificial immunisation algorithm. Engineering Materials 439(1), 29–34 (2010)Google Scholar
- 2.Colajanni, M., Marchetti, M., Messori, M.: Selective and early threat detection in large networked systems. In: Proc. of the 10th IEEE International Conference on Computer and Information Technology, CIT 2010 (2010)Google Scholar
- 3.Capture the flag traffic dump, http://www.defcon.org/html/links/dc-ctf.html
- 5.Kohonen, T.: The self-organizing map, vol. 78(9) (1990)Google Scholar
- 6.Mukkamala, S., Janoski, G., Sung, A.: Intrusion detection using neural networks and support vector machines. In: Proceedings of the 2002 International Joint Conference on Neural Networks (2002)Google Scholar
- 7.Munesh, K., Shoaib, S., Humera, N.: Feature-based alert correlation in security systems using self organizing maps. In: Proceedings of SPIE, the International Society for Optical Engineering (2009)Google Scholar
- 9.Pelleg, D., Moore, A.: X-means: Extending k-means with efficient estimation of the number of clusters. In: Proc. of the 17th International Conference on Machine Learning, pp. 727–734. Morgan Kaufmann, San Francisco (2000)Google Scholar
- 10.Snort home page, http://www.snort.org
- 11.Su, M.C., Liu, T.K., Chang, H.T.: Improving the self-organizing feature map algorithm using an efficient initialization scheme. Tamkang Journal of Science and Engineering 5(1), 35–48 (2002)Google Scholar
- 13.Vokorokos, L., Baláz, A., Chovanec, M.: Intrusion detection system using self organizing map, vol. 6(1) (2006)Google Scholar
- 14.Yoo, J.H., Kang, B.H., Kim, J.W.: A clustering analysis and learning rate for self-organizing feature map. In: Proc. of the 3rd International Conference on Fuzzy Logic, Neural Networks and Soft Computing (1994)Google Scholar