Techniques and tools for analyzing intrusion alerts

摘要: Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where are intensive attacks, not only will actual mixed with false alerts, but the amount of also become unmanageable. As a result, it is difficult for human users response to understand take appropriate actions. This paper presents sequence techniques address this issue. The first technique constructs attack scenarios by correlating basis prerequisites consequences attacks. Intuitively, prerequisite an necessary condition successful, while consequence possible outcome attack. Based different types proposed method correlates (partially) matching some prior later ones. Moreover, handle large collections set interactive analysis utilities aimed at facilitating investigation sets alerts. development toolkit named TIAA, which provides system support analysis. finally reports experiments conducted validate 2000 DARPA scenario-specific datasets, data collected DEFCON 8 Capture Flag event.