Anti-correlation as a criterion to select appropriate counter-measures in an intrusion detection framework

Abstract

Since current computer infrastructures are increasingly vulnerable to malicious activities, intrusion detection is necessary but unfortunately not sufficient. We need to design effective response techniques to circumvent intrusions when they are detected. Our approach is based on a library that implements different types of counter-measures. The idea is to design a decision support tool to help the administrator to choose, in this library, the appropriate counter-measure when a given intrusion occurs. For this purpose, we formally define the notion of anti-correlation which is used to determine the counter-measures that are effective to stop the intrusion. Finally, we present a pla!form of intrusion detection that implements the response mechanisms presented in this paper. R~sum~Etant donn6 que les systbmes informatiques sont de plus en plus vuln6rables aux activit(s malveillantes, l' utilisation de la d6tection d'intrusion est n(cessaire mais ne suffit pas. Nous devons (laborer des m6thodes efficaces de r(action aux intrusions afin d'arr~ter les intrusions d(tect~es. Notre approche est bas6e sur une biblioth~que de diff(rents types de contremesures. L'objectif est d'aider l'administrateur & choisir dans cette bibliothkque la contre-mesure la mieux adapt~e quand une intrusion est d(tect~e. Pour ce faire nous d~finis-sons formellement la notion d'anti-corr6lation qui est utilis6e pour s6lectionner les contremesures permettant d'arr6ter l'intrusion. Nous finissons par la presentation d'une plateforme de d(tection d'intrusion mettant en ~euvre les m(canismes pr(sent6s dans cet article. Mots cl6s : S6curit~ informatique, D6tecteur intrus, Protection information. Corr61ation, Mod~lisation, ModUle logique.

Distributed Exchange of Alerts for the Detection of Coordinated Attacks

“…Let us start by having a look to the main components of our attack prevention system [1,3]. A description of each component is presented in the following.…”

“…All possible classifications and their respective attributes must be known by all the components of the system (i.e., analyzers and managers) and all analyzers must be capable of deriving instances of local events of arbitrary types. This way, the correlation process presented in [1,3] can be realized.…”

“…It is therefore necessary to distribute a set of managers which are going to be in charge of executing a complete process to fuse, merge, and correlate the received information [1,3]. During a first stage, all the alerts associated to a single event, but reported by different analyzers, should be grouped and transformed into a single instance that uniquely identifies the occurrence of a single action in the system.…”

“…Then, in a second stage, a correlation process allows the correlation of information between different alerts by looking to those logical links between single occurrences or actions in the system. The process presented in [1] shows how it is possible to implement this correlation process in order to find out which objectives are going to follow after these actions, and which possible countermeasures can be selected by the system in order to stop or neutralize malicious actions.…”

“…In [1,3], we presented an attack prevention framework that is targeted at detecting as well as reacting to distributed and coordinated attack scenarios. Our approach is based on gathering and correlating information held by multiple sources.…”