Earticle

초록

영어

Cyber attacks are becoming increasingly complex, especially when the target is a modern IT infrastructure, characterized by a layered architecture that integrates several security technologies such as firewalls and intrusion detection systems. These contexts can be violated by a multistep attack, that is a complex attack strategy that comprises multiple correlated intrusion activities. While a modern Intrusion Detection System detects single intrusions, it is unable to link them together and to highlight the strategy that underlies a multistep attack. Hence, a single multistep attack may generate a high number of uncorrelated intrusion alerts. The critical task of analyzing and correlating all these alerts is then performed manually by security experts. This process is time consuming and prone to human errors. This paper proposes a novel framework for the analysis and correlation of security alerts generated by state-of-the-art Intrusion Detection Systems. Our goal is to help security analysts in recognizing and correlating intrusion activities that are part of the same multistep attack scenario. The proposed framework produces correlation graphs, in which all the intrusion alerts that are part of the same multistep attack are linked together. By looking at these correlation graphs, a security analyst can quickly identify the relationships that link together seemingly uncorrelated intrusion alerts, and can easily recognize complex attack strategies and identify their final targets. Moreover, the proposed framework is able to leverage multiple algorithms for alert correlation.

목차

Abstract
 1. Introduction
 2. Framework Architecture
 3. Pseudo-Bayesian Algorithm
 4. Self-Organizing Maps
  4.1. First Processing Phase: SOM
  4.2. Second Processing Phase: k-means Clustering
  4.3. Third Processing Phase: Correlation
 5. Experimental Results
  5.1. Performance Evaluation
  5.2. Alert Correlation and Multistep Attack Detection
 6. Related Work
 7. Conclusion
 References

키워드

저자

• Mirco Marchetti [ Department of Information Engineering University of Modena and Reggio Emilia ]
• Michele Colajanni [ Department of Information Engineering University of Modena and Reggio Emilia ]
• Fabio Manganiello [ Department of Information Engineering University of Modena and Reggio Emilia ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605