Case-oriented alert correlation

摘要: Correlating alerts is of importance for identifying complex attacks and discarding false alerts. Most popular alert correlation approaches employ some well-defined knowledge to uncover the connections among However, acquiring, representing justifying such has turned out be a nontrivial task. In this paper, we propose novel method work around these difficulties by using case-based reasoning (CBR). our application, case, constructed from training data, serves as an example correlated It consists pattern caused attack identity attack. The runtime stream then compared with each see if any subset are similar in case. process reduced matching problem. Two kinds methods were explored. latter much more efficient than former. Our experiments DARPA Grand Challenge Problem simulator have shown that both produce almost same results case-oriented effective detecting intrusions.