Correlation in an intrusion detection process

Frédéric Cuppens (1) , Fabien Autrel (1) , Alexandre Miege (2) , Samuel Benferhat (3)

1 ONERA
2 ENST - Ecole Nationale Supérieure des Télécommunications
3 IRIT - Institut de recherche en informatique de Toulouse

Generally, the intruder must perform several actions, organized in an intrusion scenario, to achieve his or her malicious objective. We argue that intrusion scenarios can be modelled as a planning process and we suggest modelling a malicious objective as an attempt to violate a given security requirement. Our proposal is then to extend the definition of attack correlation presented in "alert correlation in a cooperative intrusion detection network" to correlate attacks with intrusion objectives and to introduce the notion of anti correlation. These notions are useful to decide if a sequence of correlated actions can lead to an intrusion objective. This approach provides the security administrator with a global view of what happens in the system. In particular, it controls unobserved actions through hypothesis generation, clusters repeated actions in a single scenario, recognizes intruders that are changing their intrusion objectives and is efficient to detect variations of an intrusion scenario. This approach can also be used to eliminate a category of false positives that correspond to false attacks, that is actions that are not further correlated to an intrusion objective.

Mots clés: Correlation; Intrusion detection; Intrusion detection module; Intrusion scenario

Domaines: Multimédia [cs.MM]; Réseaux et télécommunications [cs.NI]

Frédéric Cuppens, Fabien Autrel, Alexandre Miege, Samuel Benferhat. Correlation in an intrusion detection process. SECI'02 : Sécurité des Communications sur Internet, Sep 2002, Tunis, Tunisia. ⟨hal-02972076⟩