Correlating Alerts Using Prerequisites of Intrusions: Towards Reducing False Alerts and Uncovering High Level Attack Strategies

Abstract : Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there are intensive attacks, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. The objective of this project is to develop techniques and tools to facilitate the automatic (or semi-automatic) analysis of IDS alerts. In particular, we have thoroughly investigated the following issues: construction of attack scenarios from IDS alerts, efficient and effective analysis of large sets of IDS alerts, learning of attack strategies from correlated alerts, hypothesizing and reasoning about attacks missed by IDSs, integration of intrusion evidence from IDSs and other complementary information sources, alert correlation when there are privacy concerns, systematic development of the knowledge base required for alert correlation in our approach, and vulnerability analysis of MANET routing protocols to facilitate the application of alert correlation in MANET applications. We have made significant progress in this project on all these issues, as described in the report.