Extracting fuzzy attack patterns using an online fuzzy adaptive alert correlation framework
Fatemeh Faraji Daneshgar, Maghsoud Abbaspour · Security and Communication Networks · 2016
Abstract The tremendous numbers of alerts provided by intrusion detection systems have made the alert correlation a vital issue. Despite of the considerable number of proposed methods, the online alert correlation is still an open issue. In this paper we proposed an online model for alert correlation. Our model consists of two modules: (1) the online fuzzy clustering module which clusters alerts into fuzzy events based on their similarity and historical relevance; (2) the fuzzy inter event pattern mining which provides the first module with the historical relevance of alerts by mining frequent fuzzy patterns among them. Using these two modules, our approach is as fast as similarity based approaches suitable for online alert correlation while it is able to extract complex attack scenarios like offline time consuming data mining based approaches. Furthermore, observing the frequent events makes our approach capable of detecting scenarios including wrapping tricks which tries to fake the source or destination IPs. The experimental results with the well‐known dataset DARPA2000 and the ISCX UNB intrusion detection evaluation dataset proved mentioned claims. Copyright © 2016 John Wiley & Sons, Ltd.