Using attack graphs for correlating, hypothesizing, and predicting intrusion alerts

摘要: To defend against multi-step intrusions in high-speed networks, efficient algorithms are needed to correlate isolated alerts into attack scenarios. Existing correlation methods usually employ an in-memory index for fast searches among received alerts. With finite memory, the can only be built on a limited number of inside sliding window. Knowing this fact, attacker prevent two steps from both falling window by either passively delaying second step or actively injecting bogus between steps. In case, effort is defeated. paper, we first address above issue with novel queue graph (QG) approach. Instead searching all those that prepare new alert, search latest alert each type. The and other implicitly represented using temporal order Consequently, our approach arbitrarily far away, it has linear (in types) time complexity quadratic memory requirement. Then, extend basic QG unified method hypothesize missing predict future Finally, propose compact representation result correlation. Empirical results show fulfill tasks faster than IDS report Hence, promising solution administrators monitor progress thus take appropriate countermeasures timely manner.