...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Intelligent data analysis >Alert correlation: Severe attack prediction and controlling false alarm rate tradeoffs
【24h】

Alert correlation: Severe attack prediction and controlling false alarm rate tradeoffs

机译：警报关联：严重的攻击预测和虚假警报率权衡的控制

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Alert correlation plays an increasingly crucial role in nowadays computer security infrastructures. It is particularly needed for coping with the huge amounts of alerts which are daily triggered by intrusion detection systems (IDSs), fire-walls, etc. While the use of multiple IDSs, security tools and complementary approaches is fundamental and highly recommended in order to improve the overall detection rates, this however inevitably causes huge amounts of alerts most of which are redundant and false alarms making the manual analysis of these triggered alerts time-consuming and inefficient. This paper addresses three important issues related to predicting severe attacks (attacks with high dangerousness levels) by analyzing inoffensive and preparatory attacks, i) Firstly, we address the issue of preprocessing alerts reported by the multiple detection tools in order to eliminate the redundant and irrelevant alerts and format them so that they can be analyzed by a severe attack prediction model, ii) Then, we propose a novel prediction model based on a Bayesian network multi-net allowing on one hand to better model the severe attacks and on the other hand handle the reliability of IDSs when predicting severe attacks, iii) Finally, we provide a flexible and efficient approach especially designed to limit the false alarm rates by controlling the confidence of the prediction model. The main benefits of our approach is an integrated model guaranteeing very promising prediction/false alarm rate tradeoffs with minimum expert intervention. Our experimental studies are carried out on a real and representative alert corpus generated by the de facto network-based IDS Snort, and show very interesting performances regarding the tradeoffs between the prediction rates and the corresponding false alarm ones.
机译：警报关联在当今的计算机安全基础结构中扮演着越来越重要的角色。应对每天由入侵检测系统（IDS），防火墙等触发的大量警报特别需要。尽管多个IDS，安全工具和补充方法的使用是基本的，并且强烈建议使用该工具来虽然提高了整体检测率，但这不可避免地会导致大量警报，其中大多数是冗余警报和错误警报，这使得对这些触发警报进行手动分析既耗时又效率低下。本文通过分析攻击性和预备性攻击来解决与预测严重攻击（具有高危险级别的攻击）相关的三个重要问题：i）首先，我们解决了多个检测工具报告的预处理警报问题，以消除冗余和不相关的信息警报并对其进行格式化，以便可以通过严重攻击预测模型对其进行分析； ii）然后，我们提出了一种基于贝叶斯网络多网的新颖预测模型，一方面可以更好地对严重攻击进行建模，另一方面在预测严重攻击时处理IDS的可靠性。iii）最后，我们提供了一种灵活高效的方法，专门设计用于通过控制预测模型的置信度来限制误报率。我们的方法的主要优点是集成模型，可在最少的专家干预下保证非常有希望的预测/误报率折衷。我们的实验研究是在基于事实网络的IDS Snort生成的真实且具有代表性的警报语料库上进行的，并且在预测率与相应的虚警之间进行权衡时，显示出非常有趣的性能。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号