TIAA: A visual toolkit for intrusion alert analysis
Peng Ning, Pai Peng, Yiquan Hu, Dingbang Xu · NCSU Libraries Repository (North Carolina State University Libraries) · 2003
Abstract. This paper presents the development of TIAA, a visual toolkit for intrusion alert analysis. TIAA is developed to provide an interactive platform for analyzing potentially large sets of intrusion alerts reported by heterogeneous intrusion detection systems (IDSs). To ensure timely response from the system, TIAA adapts main memory index structures and query optimization techniques to improve the efficiency of intrusion alert correlation. TIAA includes a number of useful utilities to help analyze potentially intensive intrusion alerts, including alert aggregation/disaggregation, clustering analysis, focused analysis, frequency analysis, link analysis, and association analysis. Moreover, TIAA provides several ways to visualize the analysis results, making it easier for a human analyst to understand the analysis results. It is envisaged that a human analyst and TIAA form a man-machine team, with TIAA performing automated tasks such as intrusion alert correlation and execution of analysis utilities, and the human analyst deciding what sets of alerts to analyze and how the analysis utilities are applied.