NDLI: Attack Subplan-Based Attack Scenario Correlation

Content Provider	IEEE Xplore Digital Library
Author	Sheng-Hui Chien Erh-Hsien Chang Chih-Yung Yu Cheng-Seen Ho
Copyright Year	2007
Description	Author affiliation: Nat. Taiwan Univ. of Sci. & Technol., Taipei (Sheng-Hui Chien)
Abstract	There are various security sensors deployed in the network to protect the information assets from destruction. These sensors produce a huge amount of alerts in different event granularities and semantics. Such a huge amount of alerts is hard to be comprehended; as a result, a timely response to the attacks is difficult. Thus, a better technique for alert analysis and management is imperative for promoting the network security. We have developed a two layered PA-based (primitive attack-based) correlation approach to tackle this problem. The first layer does PA construction by integrating related alerts into proper PAs. The second layer is the attack subplan-based correlation layer, which does attack scenario correlation from recognized PAs by employing attack subplan templates to guide the correlation process. This paper focuses on the second layer, by discussing how to automatically construct attack subplan templates, how to eliminate invalid attack subplan templates, how the attack subplan templates can direct the process of scenario correlation, and how a proper fusion process can reduce superfluous attack information. Our experiments show this correlation approach can effectively unearth the attack strategies of the attackers, reduce the cognitive loading of the network manager in comprehending alert reports, and also relieve him from the time consuming and skillful analysis task required in manually analyzing alerts to construct correlation knowledge.
Starting Page	1881
Ending Page	1887
File Size	1437551
Page Count	7
File Format	PDF
ISBN	9781424409723
DOI	10.1109/ICMLC.2007.4370455
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2007-08-19
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intrusion detection Protection Machine learning Cybernetics Computer science Cities and towns Electronic mail Computer security Information security National security Attack scenario Attack ontology Primitive attacks Attack subplan template
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in