Statistical Causality Analysis of Infosec Alert Data

摘要: With the increasingly widespread deployment of security mechanisms, such as firewalls, intrusion detection systems (IDSs), antiviras software and authentication services, problem alert analysis has become very important. The large amount alerts can overwhelm administrators prevent them from adequately understanding analyzing state network, initiating appropriate response in a timely fashion. Recently, several approaches for correlation attack scenario have been proposed. However, these all limited capabilities detecting new scenarios. In this paper, we study with an emphasis on analysis. our framework, use clustering techniques to process low-level data into high-level aggregated alerts, conduct causal based statistical tests discover relationships among attacks. Our causality approach complements other that hard-coded prior knowledge pattern matching. We perform series experiments validate method using DARPA’s Grand Challenge Problem (GCP) datasets, 2000 DARPA Intrusion Detection Scenario DEF CON 9 datasets. results show patterns when attacks are statistically correlated.