STATL: An attack language for state-based intrusion detection

By S. T. Eckmann, Giovanni Vigna, Richard A. Kemmerer. Journal of computing and security, 2002

418 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/274f72dfa9c2285e2f73a83a80b004f3057149a1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

A survey of coordinated attacks and collaborative intrusion detection (2010, background): “STATL (Eckmann, 2002) is another state-base attack description language that is designed for correlating alerts from different IDSs in a CIDS.”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, background): “Specifically adapted to CIDSs, Fung et al. [2009] propose a trust management model that is based on Bayesian probabilities.”
Constructing attack scenarios through correlation of intrusion alerts (2002, methodology): “Several languages have been proposed to represent attacks, including STAT [Ilgun et al. 1995; Vigna and Kemmerer 1999; Eckmann et al. 2002 ], Colored-Petri Automata (CPA) [Kumar and Spafford 1994; Kumar 1995], LAMBDA [Cuppens and Ortalo 2000], and MuSig [Lin et al. 1998] and its successor [Ning et ”
Detecting Unknown Network Attacks Using Language Models (2006, background): “For misuse detection, it centers around the issues of making signatures more generic – and capable of at least not to be fooled by mutations of known attacks (3; 4; 5; 6; 7; 8).”
Toward developing a systematic approach to generate benchmark datasets for intrusion detection (2012, background): “General-purpose languages are usually used to detail the steps of an attack; however, special-purpose languages (Arboi, 2005; Cuppens and Ortalo, 2000; Eckmann et al., 2002; Michel and Mé, 2001; Networks, 1999) have also been defined to support the scripting of attacks.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, methodology): “In [43], multistep attack correlation is performed on attack scenarios specified (a priori) using STATL [16], which is a language for expressing attacks as states and transitions.”
Comprehensive approach to intrusion detection alert correlation (2004, methodology): “In our system, multistep correlation is achieved by specifying attack scenarios using STATL [13], which is an extensible language that allows one to express attack patterns using states and transitions.”