An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework
Since the rapid development of the internet, the emergence of network intrusion has become the focus of studies for scholars and security enterprises. As an important device for detecting and analyzing malicious behaviors in networks, IDS (Intrusion Detection Systems) is widely deployed in enterpris...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2019-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8862902/ |
| _version_ | 1818416121219383296 |
|---|---|
| author | Kai Zhang Fei Zhao Shoushan Luo Yang Xin Hongliang Zhu |
| author_facet | Kai Zhang Fei Zhao Shoushan Luo Yang Xin Hongliang Zhu |
| author_sort | Kai Zhang |
| collection | DOAJ |
| description | Since the rapid development of the internet, the emergence of network intrusion has become the focus of studies for scholars and security enterprises. As an important device for detecting and analyzing malicious behaviors in networks, IDS (Intrusion Detection Systems) is widely deployed in enterprises, organizations and plays a very important role in cyberspace security. The massive log data produced by IDS not only contains information about intrusion behaviors but also contains potential intrusion patterns. Through normalizing, correlating, and modeling data, we can obtain the patterns of different intrusion scenarios. Based on the previous works in the area of alert correlation and analyzing, this paper proposed a framework named IACF (Intrusion Action Based Correlation Framework), which improved the process of alert aggregating, action extraction, and scenario discovery, and applied a novel method for extracting intrusion sessions based on temporal metrics. The proposed framework utilized a new grouping method for raw alerts based on the concept of intrinsic strong correlations, rather than the conventional time windows and hyper alerts. For discovering high stable correlations between actions, redundant actions and action link modes are removed from sessions by a pruning algorithm to reduce the impact of false positives, finally, a correlation graph is constructed by fusing the pruned sessions, based on the correlation graph, a prediction method for the future attack is proposed. The experiment result shows that the framework is efficient in alert correlation and intrusion scenario construction. |
| first_indexed | 2024-12-14T11:45:51Z |
| format | Article |
| id | doaj.art-d4b7927e488c423785491be6691556b6 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-14T11:45:51Z |
| publishDate | 2019-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-d4b7927e488c423785491be6691556b62022-12-21T23:02:35ZengIEEEIEEE Access2169-35362019-01-01715054015055110.1109/ACCESS.2019.29462618862902An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction FrameworkKai Zhang0https://orcid.org/0000-0003-1424-7883Fei Zhao1https://orcid.org/0000-0003-1585-3439Shoushan Luo2Yang Xin3Hongliang Zhu4https://orcid.org/0000-0003-2448-2027National Engineering Laboratory for Disaster Backup and Recovery, Information Security Center, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, ChinaNational Engineering Laboratory for Disaster Backup and Recovery, Information Security Center, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, ChinaNational Engineering Laboratory for Disaster Backup and Recovery, Information Security Center, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, ChinaNational Engineering Laboratory for Disaster Backup and Recovery, Information Security Center, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, ChinaNational Engineering Laboratory for Disaster Backup and Recovery, Information Security Center, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, ChinaSince the rapid development of the internet, the emergence of network intrusion has become the focus of studies for scholars and security enterprises. As an important device for detecting and analyzing malicious behaviors in networks, IDS (Intrusion Detection Systems) is widely deployed in enterprises, organizations and plays a very important role in cyberspace security. The massive log data produced by IDS not only contains information about intrusion behaviors but also contains potential intrusion patterns. Through normalizing, correlating, and modeling data, we can obtain the patterns of different intrusion scenarios. Based on the previous works in the area of alert correlation and analyzing, this paper proposed a framework named IACF (Intrusion Action Based Correlation Framework), which improved the process of alert aggregating, action extraction, and scenario discovery, and applied a novel method for extracting intrusion sessions based on temporal metrics. The proposed framework utilized a new grouping method for raw alerts based on the concept of intrinsic strong correlations, rather than the conventional time windows and hyper alerts. For discovering high stable correlations between actions, redundant actions and action link modes are removed from sessions by a pruning algorithm to reduce the impact of false positives, finally, a correlation graph is constructed by fusing the pruned sessions, based on the correlation graph, a prediction method for the future attack is proposed. The experiment result shows that the framework is efficient in alert correlation and intrusion scenario construction.https://ieeexplore.ieee.org/document/8862902/Alert correlationmultistep attackcorrelation analysisintrusion scenarioattack predictionIDS alerts |
| spellingShingle | Kai Zhang Fei Zhao Shoushan Luo Yang Xin Hongliang Zhu An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework IEEE Access Alert correlation multistep attack correlation analysis intrusion scenario attack prediction IDS alerts |
| title | An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework |
| title_full | An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework |
| title_fullStr | An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework |
| title_full_unstemmed | An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework |
| title_short | An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework |
| title_sort | intrusion action based ids alert correlation analysis and prediction framework |
| topic | Alert correlation multistep attack correlation analysis intrusion scenario attack prediction IDS alerts |
| url | https://ieeexplore.ieee.org/document/8862902/ |
| work_keys_str_mv | AT kaizhang anintrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT feizhao anintrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT shoushanluo anintrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT yangxin anintrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT hongliangzhu anintrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT kaizhang intrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT feizhao intrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT shoushanluo intrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT yangxin intrusionactionbasedidsalertcorrelationanalysisandpredictionframework AT hongliangzhu intrusionactionbasedidsalertcorrelationanalysisandpredictionframework |