Alert Correlation for Extracting Attack Strategies

摘要: Alert correlation is an important technique for managing large the volume of intrusion alerts that are raised by heterogenous Intrusion Detection Systems (IDSs). The recent trend research in this area towards extracting attack strategies from raw alerts. It generally believed pure detection no longer can satisfy security needs organizations. response and prevention now becoming crucially protecting network minimizing damage. Knowing real situation a used attackers enables administrators to launches appropriate stop attacks prevent them escalating. This also primary goal using alert technique. However, most current techniques only focus on clustering inter-connected into different groups without further analyzing attackers. Some have been proposed years, but they normally require defining larger number rules. paper focuses developing new help automatically extract alerts, specific prior knowledge about these approach based two neural approaches, namely, Multilayer Perceptron (MLP) Support Vector Machine (SVM). probabilistic output methods determine with which previous should be correlated. suggests causal relationship helpful constructing scenarios. One distinguishing feature Correlation Matrix (ACM) store strengthes any types ACM updated training process, information (correlation strength) then high level strategies.