M2D2: A Formal Data Model for IDS Alert Correlation

By Benjamin Morin, Ludovic Mé, Hervé Debar, Mireille Ducassé. International Symposium on Recent Advances in Intrusion Detection, 2002

295 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Constructing attack scenarios through correlation of intrusion alerts (2002, background): “A formal model named M2D2 was proposed in [Morin et al. 2002] to correlate alerts by using multiple information sources, including the characteristics of the monitored systems, the vulnerability information, the information about the monitoring tools, and information of the observed events.”
Comprehensive approach to intrusion detection alert correlation (2004, background): “An attempt to address this limitation is described as part of the M2D2 model [31], [32], which relies on a formal description of sensor capabilities in terms of scope and positioning to determine if an alert is a false positive.”
A survey of coordinated attacks and collaborative intrusion detection (2010, background): “M2D2 (Morin et al., 2002) is a formal data model for alert correlation.”
A Survey of Visualization Systems for Network Security (2012, background): “The authors believe that port activity can be used to detect zero-day exploits that are not detectable by conventional methods.”