LATTICED: An Algebra for Intrusion Correlation

University Of Southern California, Los Angeles CA

Investigators

Abstract

Intrusion detection (ID) is an imperfect science. With state-of-the-art techniques, simple attacks with unambiguous signatures can be detected fairly easily, but trying to diagnose more complex attacks often results in a flurry of false positives and undetected attacks. This situation would be improved if ID systems could work together, so that the weaknesses of one would be covered by the strengths of another. However, most of the recent work in combining ID results has focused on the protocol and architecture of the systems. Even a process as simple as corroboration--attempting to agree on a single attack diagnosis--is not assured with only protocol and architecture. Without an underlying body of theory, efforts to combine the results of multiple ID systems will still fail. The LATTICE plan is to define a consistent and comprehensive way to combine the results of multiple ID systems. The research will employ a graph theory approach to representing the conclusions of individual ID systems. Operators can be defined to combine the graph representations of ID diagnoses in rigorous ways that can be comprehended and analyzed. The results generated by these methods can be understood as the conclusions of the multiple systems, taken as a whole. The outcome of this approach is a rigorous unifying of the abilities and strengths of all the involved ID systems.