Detection of coordinated attacks using alert correlation model
Faeiz Alserhani, Monis Akhlaq, Irfan Ullah Awan, Andrea J. Cullen · 2010
Alerts correlation techniques have been widely used to provide intelligent and stateful detection methodologies. This is to understand attack steps and predict the expected sequence of events. However, most of the proposed systems are based on rule-based mechanisms which are tedious and error prone. Other methods are based on statistical modeling; these are unable to identify causal relationships between the events. In this paper, an improved “requires/provides” model is presented which established a cooperation between statistical and knowledge-based model, to achieve higher detection rate with the minimal false positives. A knowledge-based model with vulnerability and extensional conditions provide manageable and meaningful attack graphs. The proposed model has been implemented in real-time and has successfully generated security events on establishing a correlation between attack signatures. The system has been evaluated to detect one of the most serious multi-stage attacks in cyber crime - Botnet. Zeus Botnet is analyzed within the realm of simulated malicious activities normally used by cyber criminals.