By Topic

Agent based correlation model for intrusion detection alerts

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

4 Author(s)
Ayman E. Taha ; Information System Department, Military Technical College, Egyptian Armed Forces, Cairo, Egypt ; Ismail Abdel Ghaffar ; Ayman M. Bahaa Eldin ; Hani M. K. Mahdi

Alert correlation is a promising technique in intrusion detection. It analyzes the alerts from one or more intrusion detection system and provides a compact summarized report and high-level view of attempted intrusions which highly improves security effectiveness. Correlation component is a procedure which aggregates alerts according to certain criteria. The aggregated alerts could have common features or represent steps of pre-defined scenario attacks. Correlation approaches composed of a single component or a comprehensive set of components. The effectiveness of a component depends heavily on the nature of the dataset analyzed. The order of correlation component will affect the correlation process performance. Moreover not all components should be used for different dataset. This paper presents an agent-based alert correlation model. Learning agent learns the nature of dataset within a network then guides the whole correlation process and components in such a suitable way of which components could be used and in which order. The model improves the performance of correlation process by selecting the proper components to be used. This model assures minimum alerts to be processed on each component depending on the dataset and minimum time for correlation process.

Published in:

Intelligence and Security Informatics (ISI), 2010 IEEE International Conference on

Date of Conference:

23-26 May 2010