On the alert correlation process for the detection of multi-step attacks and a graph-based realization

Abstract

Monitoring tools like Intrusion Detection Systems (IDS), Firewalls, or Honeypots are a second line of defense in the face of an increasing number of distributed, increasingly sophisticated, and targeted attacks. A huge amount of security alerts needs to be analyzed and correlated to gather the complete picture of an attack. However, most conventional IDS fall short in correlating alerts that have different sources, so that many distributed attacks remain completely unnoticed. In this paper, we define alert correlation as a process and describe the consecutive steps along with their properties and goals. Following this process, we propose Graph-based Alert Correlation (GAC), a novel correlation algorithm that isolates attacks, identifies attack scenarios, and assembles multi-stage attacks from huge alert sets. Our evaluation results on artificial and real-world data indicates that GAC is robust against false positives, can detect distributed attacks, and scales with an increasing number of alerts.