Network intrusion alert correlation challenges and techniques
Many organizations implement Intrusion Detection Systems (IDS) as the first line of defense for their security systems. Up to now, the researchers have developed IDS in many computer environments. Having detected the signs of intrusions, IDS trigger alerts to report them. These alerts are presented...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Penerbit UTM Press
2008
|
| Subjects: | |
| Online Access: | http://eprints.utm.my/9423/1/MaheyzahMdSiraj2008_NetworkIntrusionAlertCorrelation.pdf |
| _version_ | 1825910307950690304 |
|---|---|
| author | Md. Siraj, Maheyzah Mohd. Hashim, Siti Zaiton |
| author_facet | Md. Siraj, Maheyzah Mohd. Hashim, Siti Zaiton |
| author_sort | Md. Siraj, Maheyzah |
| collection | ePrints |
| description | Many organizations implement Intrusion Detection Systems (IDS) as the first line of defense for their security systems. Up to now, the researchers have developed IDS in many computer environments. Having detected the signs of intrusions, IDS trigger alerts to report them. These alerts are presented to human analyst to be evaluated and initiates adequate responses. But, manually analyzing those alerts are tedious, time-consuming and error-prone. The reasons for this: the number of alerts is enormous, and (2) most of them are false alerts. A promising method to automate the alert analysis is finding the correlation between alerts, and such system is known as Alert Correlation System (ACS). One of the major applications of alert correlation (AC) is attack diagnosis. Interestingly, researchers have different kind of views to define the concept of AC. Furthermore, a various types of techniques have been proposed in AC: to reduce the false alerts, and (2) to find causality relationship between alerts to extract the strategies of attacker. This paper discussed the challenges of ACS and the most importantly presents a review of techniques and solutions proposed in the course of the last ten years, while comparing their advantages and limitations. The survey is followed by the presentation of potential future research directions in this area. |
| first_indexed | 2024-03-05T18:15:09Z |
| format | Article |
| id | utm.eprints-9423 |
| institution | Universiti Teknologi Malaysia - ePrints |
| language | English |
| last_indexed | 2024-03-05T18:15:09Z |
| publishDate | 2008 |
| publisher | Penerbit UTM Press |
| record_format | dspace |
| spelling | utm.eprints-94232017-11-01T04:17:22Z http://eprints.utm.my/9423/ Network intrusion alert correlation challenges and techniques Md. Siraj, Maheyzah Mohd. Hashim, Siti Zaiton QA75 Electronic computers. Computer science Many organizations implement Intrusion Detection Systems (IDS) as the first line of defense for their security systems. Up to now, the researchers have developed IDS in many computer environments. Having detected the signs of intrusions, IDS trigger alerts to report them. These alerts are presented to human analyst to be evaluated and initiates adequate responses. But, manually analyzing those alerts are tedious, time-consuming and error-prone. The reasons for this: the number of alerts is enormous, and (2) most of them are false alerts. A promising method to automate the alert analysis is finding the correlation between alerts, and such system is known as Alert Correlation System (ACS). One of the major applications of alert correlation (AC) is attack diagnosis. Interestingly, researchers have different kind of views to define the concept of AC. Furthermore, a various types of techniques have been proposed in AC: to reduce the false alerts, and (2) to find causality relationship between alerts to extract the strategies of attacker. This paper discussed the challenges of ACS and the most importantly presents a review of techniques and solutions proposed in the course of the last ten years, while comparing their advantages and limitations. The survey is followed by the presentation of potential future research directions in this area. Penerbit UTM Press 2008-12 Article PeerReviewed application/pdf en http://eprints.utm.my/9423/1/MaheyzahMdSiraj2008_NetworkIntrusionAlertCorrelation.pdf Md. Siraj, Maheyzah and Mohd. Hashim, Siti Zaiton (2008) Network intrusion alert correlation challenges and techniques. Jurnal Teknologi Maklumat, 20 (2). pp. 12-36. ISSN 0128-3790 |
| spellingShingle | QA75 Electronic computers. Computer science Md. Siraj, Maheyzah Mohd. Hashim, Siti Zaiton Network intrusion alert correlation challenges and techniques |
| title | Network intrusion alert correlation challenges and techniques |
| title_full | Network intrusion alert correlation challenges and techniques |
| title_fullStr | Network intrusion alert correlation challenges and techniques |
| title_full_unstemmed | Network intrusion alert correlation challenges and techniques |
| title_short | Network intrusion alert correlation challenges and techniques |
| title_sort | network intrusion alert correlation challenges and techniques |
| topic | QA75 Electronic computers. Computer science |
| url | http://eprints.utm.my/9423/1/MaheyzahMdSiraj2008_NetworkIntrusionAlertCorrelation.pdf |
| work_keys_str_mv | AT mdsirajmaheyzah networkintrusionalertcorrelationchallengesandtechniques AT mohdhashimsitizaiton networkintrusionalertcorrelationchallengesandtechniques |