Recognizing Malicious Intention in an Intrusion Detection Process.
Frédéric Cuppens, Fabien Autrel, Alexandre Miège, Salem Benferhat · PolyPublie (École Polytechnique de Montréal) · 2002
Generally, the intruder must perform several actions, organized in an intrusion scenario, to achieve his or her malicious objective. We argue that intrusion scenarios can be modelled as a planning process and we suggest modelling a malicious objective as an attempt to violate a given security requirement. Our proposal is then to extend the definition of attack correlation presented in [CM02] to correlate attacks with intrusion objectives This notion is useful to decide if a sequence of correlated actions can lead to a security requirement violation. This approach provides the security administrator with a global view of what happens in the system. In particular, it controls unobserved actions through hypothesis generation, clusters repeated actions in a single scenario, recognizes intruders that are changing their intrusion objectives and is efficient to detect variations of an intrusion scenario. This approach can also be used to eliminate a category of false positives that correspond to false attacks, that is actions that are not further correlated to an intrusion objective.