Enhanced Correlation in an Intrusion Detection Process

Benferhat, Salem; Autrel, Fabien; Cuppens, Frédéric

doi:10.1007/978-3-540-45215-7_13

Cited by 16 publications

(4 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This approach is called alert aggregation and fusion in [3]. The second definition presents attack detection alert correlation as the process of finding a set of alerts, organized into an attack scenario, into the stream of attack detection alerts generated by some IDS [13,5,4,2].…”

Section: Correlation Of Alertsmentioning

confidence: 99%

“…Each prevention cell has its response units responsible for launching actions allowing the termination of ongoing scenarios. In order to detect when a counter measure must be launched, we use the anti-correlation mechanism defined in [2]. On the modelization point of view, the counter measures are not different from the models representing the set of actions available for the intruder.…”

Section: Scenario Modelization As Exposed Inmentioning

confidence: 99%

“…This mechanism is provided by the correlation engine through the hypothesis generation mechanism [2]. Each time a new alert is received, the correlation engine finds a set of action models that can be correlated in order to form a scenario leading to an attack objective.…”

Section: Scenario Modelization As Exposed Inmentioning

confidence: 99%

See 2 more Smart Citations

Decentralized Publish-Subscribe System to Prevent Coordinated Attacks via Alert Correlation

García

Autrel

Borrell

et al. 2004

Information and Communications Security

Self Cite

View full text Add to dashboard Cite

We present in this paper a decentralized architecture to correlate alerts between cooperative nodes in a secure multicast infrastructure. The purpose of this architecture is to detect and prevent the use of network resources to perform coordinated attacks against third party networks. By means of a cooperative scheme based on message passing, the different nodes of this system will collaborate to detect its participation on a coordinated attack and will react to avoid it. An overview of the implementation of this architecture for GNU/Linux systems will demonstrate the practicability of the system.

show abstract

Section: Correlation Of Alertsmentioning

confidence: 99%

Section: Scenario Modelization As Exposed Inmentioning

confidence: 99%

See 1 more Smart Citation

Decentralized Publish-Subscribe System to Prevent Coordinated Attacks via Alert Correlation

García

Autrel

Borrell

et al. 2004

Information and Communications Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…It is then possible to extrapolate this scenario to predict future attacks that the intruder will probably perform and the objective that he attempts to achieve. When several possible scenarios are extrapolated, [2] suggests an approach to define an order of preference between these scenarios to select the most likely ones.…”

Section: Correlation and Anti-correlationmentioning

confidence: 99%

Selecting appropriate counter-measures in an intrusion detection framework

Cuppens¹,

Gombault²,

Sans³

Proceedings. 17th IEEE Computer Security Foundations Workshop, 2004.

View full text Add to dashboard Cite

Since current computer infrastructures are increasingly vulnerable to malicious activities, intrusion detection is necessary but unfortunately not sufficient. We need to design effective response techniques to circumvent intrusions when they are detected. Our approach is based on a library that implements different types of counter-measures. The idea is to design a decision support tool to help the administrator to choose, in this library, the appropriate counter-measure when a given intrusion occurs. For this purpose, we formally define the notion of anti-correlation which is used to determine the counter-measures that are effective to stop the intrusion. Finally, we present a platform of intrusion detection, called DIAMS, that implements the response mechanisms presented in this paper.

show abstract