Aggregation and Correlation of Intrusion-Detection Alerts

By Hervé Debar, Andreas Wespi. International Symposium on Recent Advances in Intrusion Detection, 2001

726 citations recorded by the source corpus.

Subfields: Biomedical Engineering, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/3c1f860a678f3f6f33f2cbfdfa7dfc7119a57a00

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Biomedical Engineering

1. Klaus Julisch
2. Hervé Debar
3. Adam Bates
4. Daniel Marino
5. Peng Ning
6. Yun Cui
7. Wajih Ul Hassan
8. Douglas S. Reeves

In Computer Networks and Communications

1. Adam Bates
2. Wajih Ul Hassan
3. Daniel Marino
4. Giovanni Vigna
5. Christopher Krügel
6. Fredrik Valeur
7. Shanika A. Karunasekera
8. Chenfeng Vincent Zhou

In Signal Processing

1. Adam Bates
2. Wajih Ul Hassan
3. Giovanni Vigna
4. Daniel Marino
5. Christopher Krügel
6. Fredrik Valeur
7. Chenfeng Vincent Zhou
8. Shanika A. Karunasekera

Citations in the corpus

• SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “The main approaches, often used together, are to cluster similar alerts, prioritize alerts, and identify causal relationships between alerts [14, 43, 46, 44, 56].”
• M2D2: A Formal Data Model for IDS Alert Correlation (2002, methodology): “In other existing alert formats, source and target concepts are attributes of the alerts [12, 13 ].”
• A Survey of Visualization Systems for Network Security (2012, background): “The authors believe that port activity can be used to detect zero-day exploits that are not detectable by conventional methods.”
• Constructing attack scenarios through correlation of intrusion alerts (2002, methodology): “The contribution of this paper includes a formal framework for alert correlation, the implementation of an o.-line alert cor­relator based on the framework, and the evaluation of our method with the 2000 DARPA intrusion detection scenario speci.c datasets.”
• A survey of coordinated attacks and collaborative intrusion detection (2010, background): “Debar and Wespi (2001) proposed an aggregation and correlation algorithm for intrusion alerts from various detection sensors.”
• Mining intrusion detection alarms for actionable knowledge (2002, background): “Alarm correlation systems [12, 14, 40, 42] try to group alarms so that the alarms of the same group pertain to the same phenomenon (e.g. the same attack).”
• HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, methodology): “Several approaches use alarm correlation to perform detection by clustering similar alarms and by identifying causal relationships between alarms [15], [42], [43], [48], [54].”
• Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “Existing systems use statistical-, heuristic-, and probabilistic-based alert correlation [69], [70], [71], [72], [73] to correlate alerts.”
• Comprehensive approach to intrusion detection alert correlation (2004, background): “In [8], Debar and Wespi propose a system that performs both aggregation and correlation of intrusion detection alerts produced by a number of different sensors.”