Probabilistic Alert Correlation

By Alfonso Valdes, Keith Skinner. International Symposium on Recent Advances in Intrusion Detection, 2001

704 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/b663111767bfa1b6cc123b782f4abff4e4504270

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “One major vein of research in intrusion report correlation is that of alert fusion, i.e., clustering similar events under a single label [42].”
Managing alerts in a multi-intrusion detection environment (2001, background): “This problem was addressed by Valdes and Skinner [21].”
Global Intrusion Detection in the DOMINO Overlay System (2004, background): “Finally, we provide preliminary results from our prototype active sink deployment that illustrates the limited variability in the sink traffic and the feasibility of efficient classification and discrimination of attack types.”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, background): “Taxonomy and Survey of Collaborative Intrusion Detection 55:17 techniques [Valdes and Skinner 2001; Porras et al. 2002], as seen in Section 3, that have been tested in an environment.”
Mining intrusion detection alarms for actionable knowledge (2002, background): “Alarm correlation systems [12, 14, 40, 42] try to group alarms so that the alarms of the same group pertain to the same phenomenon (e.g. the same attack).”
Immune system approaches to intrusion detection – a review (2004, background): “Approaches have been based on finding statistical similarities between alerts [115], fusing alerts into attack scenarios [28], and knowing the prerequisites and consequences of certain attacks [1].”
A survey of coordinated attacks and collaborative intrusion detection (2010, background): “Valdes and Skinner (2001) proposed a probabilistic alert correlation approach for the EMERALD (Porras and Neumann, 1997) project.”
Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “Existing systems use statistical-, heuristic, and probabilistic-based alert correlation [69], [70], [71], [72], [73] to correlate alerts.”
Alert correlation in a cooperative intrusion detection framework (2002, background): “3 Notice that several authors use the terms “alert correlation” for functions that actually correspond to “alert merging” in our terminology (see [13] for instance).”
Clustering intrusion detection alarms to support root cause analysis (2003, background): “Alarm Correlation Systems (ACSs) [Cuppens 2001; Cuppens and Miège 2002; Dain and Cunningham 2002; Debar and Wespi 2001; Staniford et al. 2000; Valdes and Skinner 2001] try to group alarms so that the alarms of the same group pertain to the same phenomenon (e.”
Comprehensive approach to intrusion detection alert correlation (2004, methodology): “For example, the model proposed by Andersson et al. [1] and Valdes and Skinner [47], [48] present a correlation process in two phases.”