Intrusion Detection And Correlation

by Kruegel, Christopher; VALEUR, FREDRIK; Vigna, Giovanni

• ISBN13: 9780387233987
• ISBN10: 0387233989
• Format: Hardcover
• Copyright: 2004-11-30
• Publisher: Springer-Verlag New York Inc

Summary

Intrusion Detection and Correlation: Challenges and Solutions presents intrusion detection systems (IDSs) and addresses the problem of managing and correlating the alerts produced. This volume discusses the role of intrusion detection in the realm of network security with comparisons to traditional methods such as firewalls and cryptography. The Internet is omnipresent and companies have increasingly put critical resources online. This has given rise to the activities of cyber criminals. Virtually all organizations face increasing threats to their networks and the services they provide. Intrusion detection systems (IDSs) take increased pounding for failing to meet the expectations researchers and IDS vendors continually raise. Promises that IDSs are capable of reliably identifying malicious activity in large networks were premature and never tuned into reality. While virus scanners and firewalls have visible benefits and remain virtually unnoticed during normal operations, the situation is different with intrusion detection sensors. State-of-the-art IDSs produce hundreds or even thousands of alerts every day. Unfortunately, almost all of these alerts are false positives, that is, they are not related to security-relevant incidents.INTRUSION DETECTION AND CORRELATION: Challenges and Solutions analyzes the challenges in interpreting and combining (i.e., correlating) alerts produced by these systems. In addition, existing academic and commercial systems are classified; their advantage and shortcomings are presented, especially in the case of deployment in large, real-world sites.

Table of Contents

List of Figures	ix
List of Tables	xi
Preface	xiii
1. INTRODUCTION	1	(8)
1 Motivating Scenario	3	(3)
2 Alert Correlation	6	(1)
3 Organization	7	(2)
2. COMPUTER SECURITY AND INTRUSION DETECTION	9	(20)
1 Security Attacks and Security Properties	9	(2)
2 Security Mechanisms	11	(6)
2.1 Attack Prevention	11	(1)
2.2 Attack Avoidance	12	(5)
2.3 Attack Detection	17	(1)
3 Intrusion Detection	17	(18)
3.1 Architecture	19	(1)
3.2 Taxonomy	20	(1)
3.3 Detection Method	21	(4)
3.4 Type of Response	25	(1)
3.5 Audit Source Location	25	(3)
3.6 Usage Frequency	28	(1)
3.7 IDS Cooperation and Alert Correlation	28	(1)
3. ALERT CORRELATION	29	(6)
4. ALERT COLLECTION	35	(8)
1 Alert Normalization	36	(1)
2 Alert Preprocessing	37	(6)
2.1 Determining the Alert Time	38	(4)
2.2 Determining the Alert's Source and Target	42	(1)
2.3 Determining the Attack's Name	42	(1)
5. ALERT AGGREGATION AND VERIFICATION	43	(16)
1 Alert Fusion	43	(2)
2 Alert Verification	45	(7)
2.1 Passive Approach	48	(1)
2.2 Active Approach	48	(4)
3 Attack Thread Reconstruction	52	(1)
4 Attack Session Reconstruction	53	(3)
5 Attack Focus Recognition	56	(3)
6. HIGH-LEVEL ALERT STRUCTURES	59	(12)
1 Multistep Correlation	59	(4)
2 Impact Analysis	63	(2)
3 Alert Prioritizing	65	(1)
4 Alert Sanitization	66	(5)
7. LARGE-SCALE CORRELATION	71	(22)
1 Pattern Specification	77	(3)
1.1 Definitions	77	(1)
1.2 Attack Specification Language	78	(1)
1.3 Language Grammar	79	(1)
2 Pattern Detection	80	(13)
2.1 Basic Data Structures	80	(2)
2.2 Constraints	82	(1)
2.3 Detection Process	83	(7)
2.4 Implementation Issues	90	(3)
8. EVALUATION	93	(10)
1 Evaluation of Traditional ID Sensors	93	(2)
1.1 Evaluation Efforts	94	(1)
1.2 Problems	95	(1)
2 Evaluation of Alert Correlators	95	(8)
2.1 Evaluation Efforts	96	(2)
2.2 Problems	98	(1)
2.3 Correlation Evaluation Truth Files	99	(1)
2.4 Factors Affecting the Alert Reduction Rate	100	(3)
9. OPEN ISSUES	103	(6)
1 Intrusion Detection	103	(3)
2 Alert Correlation	106	(3)
10. CONCLUSIONS	109	(2)
References	111	(6)
Index	117