Abstracting and correlating heterogeneous events to detect complex scenarios

摘要: The research presented in this thesis addresses inherent problems signaturebased intrusion detection systems (IDSs) operating heterogeneous environments. proposes a solution to address the difficulties associated with multistep attack scenario specification and for such has focused on two distinct problems: representation of events derived from sources multi-step detection. first part investigates application an event abstraction model logs collected environment. comprises hierarchy different log as system audit data, logs, captured network traffic, alerts. Unlike existing models where low-level information may be discarded during process, work preserves all well providing high-level form abstract events. was designed independently any particular IDS thus used by IDS, forensic tools, or monitoring tools. second use unification Multi-step scenarios are hard specify detect they often involve correlation multiple which affected time uncertainty. algorithm provides simple straightforward matching mechanism using variable instantiation variables represent defined model. third looks into Clock synchronisation is crucial detecting hosts. Issues involving uncertainty have been largely neglected research. introduces techniques addressing issues: clock skew compensation drift modelling linear regression. An off-line prototype attacks implemented. modules: implementation architecture (AESA) module. module implements our signature language developed based Python programming syntax unification-based engine. evaluated publicly available dataset real traffic synthetic dataset. features public fact that it contains hosts drift. These allow us demonstrate advantages contributions All instances correctly identified even though there exists significant Future would develop refined suitable processing streams enable on-line In terms uncertainty, future mechanisms allows automatic identification correction. immediate framework processes can