Reduce False Alerts, Uncover High-Level Attack Strategies and Predict Attacks in Progress Using Prerequisites of Intrusions

North Carolina State University, Raleigh NC

Investigators

Abstract

Current intrusion detection systems (IDSs) usually generate many false alerts and often do not detect novel attacks or variations of known attacks. Moreover, most existing IDSs focus on low-level attacks or anomalies; none capture the logical steps or strategies behind these attacks. In situations where there are intensive intrusions, not only will actual alerts be mixed with false alerts, but the number of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the nature of the attack and to take appropriate actions. To address these issues, this project will investigate techniques to correlate intrusion alerts on the basis of the prerequisites and consequences of attacks. The research uses a formal and rigorous approach to study the fundamental issues involved in alert correlation, including representation of prerequisites and consequences of attacks, efficient algorithms to process alerts, expressiveness of the high-level representation mechanisms, effectiveness of the technique in reducing false alerts, impact of false alerts and undetected attacks on the technique, and methods to predict attacks in progress. Expected impacts of the proposed research include (1) a reduction in the number of false alerts, (2) identification of attackers' high-level strategies, and (3) early configuration of effective defenses against attacks in progress. If successful, the research will lead to better tools for intrusion detection and thus to improved computer and network security.