Real-Time Alert Correlation with Type Graphs
Gianni Tedesco, Uwe Aickelin

TL;DR
This paper introduces a novel real-time alert correlation algorithm using type graphs that unifies correlation and hypothesizing, improving efficiency and output compactness in intrusion detection systems.
Contribution
The paper presents a new type-graph algorithm that combines alert correlation and hypothesizing into a single, efficient operation.
Findings
Highly efficient with intensive alerts
Produces compact output graphs
Comparable performance to existing techniques
Abstract
The premise of automated alert correlation is to accept that false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which attacks can be combined. These algorithms can be classified in to two broad categories namely scenario-graph approaches, which create an attack model starting from a vulnerability assessment and type-graph approaches which rely on an abstract model of the relations between attack types. Some research in to improving the efficiency of type-graph correlation has been carried out but this research has ignored the hypothesizing of missing alerts. Our work is to present a novel type-graph algorithm which unifies correlation and hypothesizing in to a single operation. Our experimental results indicate…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Advanced Malware Detection Techniques
