By Topic

Event-Based Alert Correlation System to Detect SQLI Activities

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$31 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

4 Author(s)
Alserhani, F. ; Inf. Res. Inst., Univ. of Bradford, Bradford, UK ; Akhlaq, M. ; Awan, I.U. ; Cullen, A.J.

Alerts correlation techniques have been widely used to provide intelligent and stateful detection methodologies. This is to understand attack steps and predict the expected sequence of events. However, most of the proposed systems are based on rule - based mechanisms which are tedious and error prone. Other methods are based on statistical modeling, these are unable to identify causal relationships between the events. In this paper, we have identified the limitations of the current techniques and propose a model for alert correlation that overcomes the shortcomings. An improved "require/provide" model is presented which established a cooperation between statistical and knowledge-based model, to achieve higher detection rate with the minimal false positives. A knowledge-based model with vulnerability and extensional conditions provide manageable and meaningful attack graphs. The proposed model has been implemented in real-time and has successfully generated security events on establishing a correlation between attack signatures. The system has been evaluated to detect one of the most serious multi-stage attacks in cyber crime -- SQLIA (SQL Injection Attack). Typical SQLIA steps are analyzed within the realm of simulated malicious activities normally used by cyber criminals. The system has efficiently established a correlation in attack behaviors and has generated an attack map. The map can be used to discretely analyze the correlated attack activities which in other case may go undetected thus facilitating the multi-stage attack recognition process.

Published in:

Advanced Information Networking and Applications (AINA), 2011 IEEE International Conference on

Date of Conference:

22-25 March 2011