A Bayesian network-based approach for learning attack strategies from intrusion alerts

摘要: A tremendous number of low-level alerts reported by information security systems clearly reflect the need for an advanced alert correlation system to reduce redundancy, correlate alerts, detect attack strategies, and take appropriate actions against upcoming attacks. Up now, a variety methods have been suggested. However, most them rely on priori hard-coded domain expert knowledge that leads their difficult implementation limited capabilities detecting new strategies. To overcome drawbacks these approaches, recent trend research in has gone towards extracting strategies through automatic analysis intrusion alerts. In line with researches, this paper, we present algorithms automatically mine behavior patterns from historical as accurately efficiently possible. Our is composed two main components. The first offline component generates rules analyzing previously observed using Bayesian causality mechanism. Then, online component, are correlated hierarchical scheme based extracted rules. experimental results show efficiency proposed method learning Copyright © 2013 John Wiley & Sons, Ltd.