Intrusion Detection and Correlation

Contents

List of Figures

List of Tables

Preface

1 INTRODUCTION

1. Motivating Scenario

2. Alert Correlation

3. Organization

2 COMPUTER SECURITY AND INTRUSION DETECTION

1. Security Attacks and Security Properties

2. Security Mechanisms

2.1 Attack Prevention

2.2 Attack Avoidance

2.3 Attack Detection

3. Intrusion Detection

3.1 Architecture

3.2 Taxonomy

3.3 Detection Method

3.4 Type of Response

3.5 Audit Source Location

3.6 Usage Frequency

3.7 IDS Cooperation and Alert Correlation

3 ALERT CORRELATION

4 ALERT CORRELATION ALERT COLLECTION

1. Alert Normalization

2. Alert Preprocessing

2.1 Determining the Alert Time

2.2 Determining the Alert’s Source and Target

2.3 Determining the Attack’s Name

5 ALERT AGGREGATION AND VERIFICATION

1. Alert Fusion

2. Alert Verification

2.1 Passive Approach

2.2 Active Approach

3. Attack Thread Reconstruction

4. Attack Session Reconstruction

5. Attack Focus Recognition

6 HIGH-LEVEL ALERT STRUCTURES

1. Multistep Correlation

2. Impact Analysis

3. Alert Prioritizing

4. Alert Sanitization

7 LARGE-SCALE CORRELATION

1. Pattern Specification

1.1 Definitions

1.2 Attack Specification Language

1.3 Language Grammar

2. Pattern Detection

2.1 Basic Data Structures

2.2 Constraints

2.3 Detection Process

2.4 Implementation Issues

8 EVALUATION

1. Evaluation of Traditional ID Sensors

1.1 Evaluation Efforts

1.2 Problems

2. Evaluation of Alert Correlators

2.1 Evaluation Efforts

2.2 Problems

2.3 Correlation Evaluation Truth Files

2.4 Factors Affecting the Alert Reduction Rate

9 OPEN ISSUES

1. Intrusion Detection

2. Alert Correlation

10 CONCLUSIONS

References

Index