A Cognitive Model for Alert Correlation in a Distributed Environment

Abstract

Abstract. The area of alert fusion for strengthening information assurance in systems is a promising research area that has recently begun to attract attention. Increased demands for "more trustworthy" systems and the fact that a single sensor cannot detect all types of misuse/anomalies have prompted most modern information systems deployed in distributed environments to employ multiple, diverse sensors. Therefore, the outputs of the sensors must be fused in an effective and intelligent manner in order to provide an overall view of the status of such systems. A unified architecture for intelligent alert fusion will essentially combine alert prioritization, alert clustering and alert correlation. In this paper, we address the alert correlation aspect of sensor data fusion in distributed environments. A causal knowledge based inference technique with fuzzy cognitive modeling is used to correlate alerts by discovering causal relationships in alert data.

A Flexible and Efficient Alert Correlation Platform for Distributed IDS

“…In terms of Prioritization, the alerts are categorized based on their severity, e.g., using attack ranks [14]. To solve problems of alert correlation, a variety of disciplines are used, e.g., machine learning, data mining [11], or fuzzy techniques [12]. Most of the efforts do not consider the aspect of performance, which is needed in case of huge amounts of alerts.…”

“…The correlation algorithms [1] can be classified as: Scenario-based correlation [7], Rule-based correlation [8], Statistical correlation [9], and Temporal correlation [10]. False alert reduction can be done by using such techniques as data mining [11] or fuzzy techniques [12]. Attack strategy analysis often depends on reasoning and prediction of attacks missed by the IDS [13].…”

Reducing the Cognitive Load on Analysts through Hamming Distance Based Alert Aggregation

“…The first category involves expert knowledge used to construct a system for classifying, correlating, and ranking alerts based on external knowedge of existing attacks [3] [10]. Rules may also be aggregated using userdefined similarity metrics based on expert knowledge [3], and some alerts may be completely ignored outright if prior knowledge suggests that they are irrelevant [13].…”

An alert correlation platform for memory‐supported techniques

“…if a set of alerts shows the same time pattern of occurrence, the alerts are correlated. False alert reduction can be done by using such techniques as data mining [26] or fuzzy techniques [27]. Attack strategy analysis often depends on reasoning and prediction of attacks missed by the IDS [28].…”

“…To solve problems of alert correlation, a variety of disciplines are used, e.g. machine learning, data mining [26], or fuzzy techniques [27]. Most of the efforts do not consider the aspect of performance, which is needed in the case of huge amounts of alerts.…”