Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts
Ismail Abdel Ghafar, Ayman Taha, Ayman Mohammad Bahaa-Eldin, Hani M. K. Mahdi · The International Conference on Electrical Engineering/The International Conference on Electrical Engineering · 2010
Alert correlation is a promising technique in intrusion detection. It analyzes the alertsfrom one or more intrusion detection system and provides a compact summarizedreport and high-level view of attempted intrusions which highly improves securityeffectiveness. Correlation component is a procedure which aggregates alertsaccording to certain criteria. The aggregated alerts could have common features orrepresent steps of pre-defined scenario attacks. Correlation approaches composed ofa single component or a comprehensive set of components. The effectiveness of acomponent depends heavily on the nature of the real alerts or the dataset analyzed.The order of correlation components affects the correlation process performance.Moreover not all components should be used for different dataset. This paperpresents implementation of an Agent Based Correlation Model for real-time intrusiondetection alerts. Learning agent learns the nature of alerts within a network thenguides the whole correlation process and components in such a suitable way of whichcomponents could be used and in which order. The model improves the performanceof correlation process by selecting the proper components to be used. The simulationresults showed that ABCM model assures minimum alerts to be processed on eachcomponent depending on the dataset and minimum time for correlation process.