Constructing attack scenarios through correlation of intrusion alerts

By Peng Ning, Yun Cui, Douglas S. Reeves. Conference on Computer and Communications Security, 2002

593 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

MulVAL: A Logic-based Network Security Analyzer (2005, background): “Intrusion detection systems have been widely deployed in networks and extensively studied in the literature [5, 16, 14].”
Incentive-based modeling and inference of attacker intent, objectives, and strategies (2003, unknown): “Although alert correlation techniques [7, 26] may reduce”
A survey of coordinated attacks and collaborative intrusion detection (2010, methodology): “Ning et al. (2002) proposed a similar alert correlation approach based on the prerequisites and consequences of intrusions.”
Efficient minimum-cost network hardening via exploit dependency graphs (2003, background): “The notion of modeling exploit sequences has been proposed for intrusion detection alert correlation [18].”
Comprehensive approach to intrusion detection alert correlation (2004, background): “Ning et al. propose a model that identifies causal relationships between alerts using prerequisites and consequences [35], [36].”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “A more applicable area of alert correlation research is multistage attack recognition, in which predefined scenario templates capture multiple state transition sequences that may be initiated by multiple threat agents [40] [29].”