Modelling intrusion for intrusion tolerance system by correlating alerts from IDS sensor
Liang Min Wang, Jian Feng, Yong Zhao Zhan · International Journal of Automation and Control · 2007
Modelling the intrusion is an open problem in Intrusion Tolerance System. But we find that alerts from the sensors of Intrusion Detection System (IDS) are helpful to solve this problem. An intrusion model based on correlating these alerts is presented in this paper, in which we place our emphasis on correlating these alerts to the intruders' inherence. Firstly, we correlate the alerts from IDS sensor into meta-attack in the constructing algorithm and then define cover as the reduction of meta-attack. Secondly, we transform the cover to intrusion model and give the proofs of the equivalences among intrusion model, meta-attack and its cover. Thirdly, we present an algorithm for describing the intrusion model without employing manual work. Finally, we do some correlation experiments to evaluate and show the performances of both the intrusion model and the algorithms for constructing and describing this model.