NDLI: Correlating intrusion events and building attack scenarios through attack graph distances

Content Provider	IEEE Xplore Digital Library
Author	Noel, S. Robertson, E. Jajodia, S.
Copyright Year	2004
Description	Author affiliation: Center for Secure Inf. Syst., George Mason Univ., Fairfax, VA, USA (Noel, S.; Robertson, E.; Jajodia, S.)
Abstract	We map intrusion events to known exploits in the network attack graph, and correlate the events through the corresponding attack graph distances. From this, we construct attack scenarios, and provide scores for the degree of causal correlation between their constituent events, as well as an overall relevancy score for each scenario. While intrusion event correlation and attack scenario construction have been previously studied, this is the first treatment based on association with network attack graphs. We handle missed detections through the analysis of network vulnerability dependencies, unlike previous approaches that infer hypothetical attacks. In particular, we quantify lack of knowledge through attack graph distance. We show that low-pass signal filtering of event correlation sequences improves results in the face of erroneous detections. We also show how a correlation threshold can be applied for creating strongly correlated attack scenarios. Our model is highly efficient, with attack graphs and their exploit distances being computed offline. Online event processing requires only a database lookup and a small number of arithmetic operations, making the approach feasible for real-time applications.
Starting Page	350
Ending Page	359
File Size	438656
Page Count	10
File Format	PDF
ISBN	0769522521
ISSN	10639527
DOI	10.1109/CSAC.2004.11
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2004-12-06
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Face detection Arithmetic Intrusion detection Context modeling Information systems Low pass filters Filtering Event detection Databases Aggregates
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances (2004)

Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances (2004)

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Detection of phrase boundaries in Japanese by low-pass filtering of fundamental frequency contours

Vehicle sound classification. Application and low pass filtering influence

Constructing attack scenarios through correlation of intrusion alerts

Event-Driven Architecture for Intrusion Detection Systems Based on Patterns

Adaptive context for medical information systems

Attack and defense information systems

Correlating intrusion events and building attack scenarios through attack graph distances

Similar Documents

Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances (2004)

Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances (2004)

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Detection of phrase boundaries in Japanese by low-pass filtering of fundamental frequency contours

Vehicle sound classification. Application and low pass filtering influence

Constructing attack scenarios through correlation of intrusion alerts

Event-Driven Architecture for Intrusion Detection Systems Based on Patterns

Adaptive context for medical information systems

Attack and defense information systems

Correlating intrusion events and building attack scenarios through attack graph distances