Intrusion alert prioritisation and attack detection using post-correlation analysis

Abstract

This is the accepted version of the paper.This version of the publication may differ from the final published version.Permanent repository link: http://openaccess.city.ac.uk/8680/ Link to published version: http://dx. AbstractEvent Correlation used to be a widely used technique for interpreting alert logs and discovering network attacks. However, due to the scale and complexity of today's networks and attacks, alert logs produced by these modern networks are much larger in volume and difficult to analyse. In this research we show that adding post-correlation methods can be used alongside correlation to significantly improve the analysis of alert logs.We proposed a new framework titled A Comprehensive System for Analysing Intrusion Alerts (ACSAnIA). The post-correlation methods include a new prioritisation metric based on anomaly detection and a novel approach to clustering events using correlation knowledge. One of the key benefits of the framework is that it significantly reduces false-positive alerts and it adds contextual information to true-positive alerts.We evaluated the post-correlation methods of ACSAnIA using data from a 2012 cyber range experiment carried out by industrial partners of the British Telecom SATURN programme. In one scenario, our results show that falsepositives were successfully reduced by 97% and in another scenario, 16%. It also showed that clustering correlated alerts aided in attack detection.The proposed framework is also being developed and integrated into a preexisting Visual Analytic tool developed by the British Telecom SATURN Research Team for the analysis of cyber security data.

Multimodal Graph Analysis of Cyber Attacks

“…Clustering algorithms had been used in past to detect cyber attacks such as intrusion detection (Shittu, Healing, Ghanea-Hercock, Bloomfield, andRajarajan 2015, Casas, Mazel, andOwezarski 2012), anomaly detection (Akoglu, Tong, and Koutra 2015), and many more. The main idea behind the intrusion detection using a clustering algorithm is based on the main idea of clustering the attack nodes in the graph together.…”

“…The main idea behind the intrusion detection using a clustering algorithm is based on the main idea of clustering the attack nodes in the graph together. Event correlation proposed by Shittu et al (Shittu, Healing, Ghanea-Hercock, Bloomfield, and Rajarajan 2015) use the post-correlation methods to cluster the correlated attacks together. Akoglu et al (Akoglu, Tong, and Koutra 2015) have summarized various applications of clustering approach to detect anomaly detection when the attacker is tampering sensitive data.…”

Feature Selection Using Information Gain for Improved Structural-Based Alert Correlation

“…Shittu et.al. [19] propsed A comperhensive System for Analysing Intrusion Alerts (ACSAnIA). it contains seven components which are: (1) Offline Correlation (2) Online Correlation (3)Meta alert Comparison (4) Meta–alert Prioritisation (5)Meta–alert Clustering (6) Attack Pattern Discovery and (7) Reporting System.…”

A Universal High-Performance Correlation Analysis Detection Model and Algorithm for Network Intrusion Detection System

“…Intrusion detection system has been studied by means of machine learning, and the detection rate has got improvements [12][13][14][15][16][17][18][19]. In addition, intrusion detection has been performed by using feature association technique, and the data set has been used for analysis [20][21][22][23][24][25].…”