Read Paper (in PDF)
Xinzhou Qin
Georgia Institute of Technology
USA
Wenke Lee
Georgia Institute of Technology
USA
Correlating and analyzing security alerts is a critical and challenging task in security management. Recently, some techniques have been proposed for security alert correlation. However, these approaches focus more on fundamental or low-level alert correlation. In this paper, based on our low-level alert correlation and analysis, we further conduct probabilistic inference to correlate and analyze attack scenarios. Specifically, we propose an approach to solving the following problems: 1) How to correlate isolated attack scenarios resulted from low-level alert correlation? 2) How to identify attacker's high-level strategies and intentions? 3) How to predict the potential attacks based on observed attack activities? We evaluate our approaches using DARPA's Grand Challenge Problem (GCP) data set. The results demonstrate the capability of our approach in correlating isolated attack scenarios, identifying attack strategies and predicting future attacks.
Keywords: Intrusion detection, alert correlation, security management, attack scenario analysis.