A vulnerability-driven approach to active alert verification

Authors:
Zhihong Tian;Binxing Fang;Bin Li;Hongli Zhang
Affiliations:
Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, China;Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, China;Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, China;Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, China
Venue:
ICCOM'05 Proceedings of the 9th WSEAS International Conference on Communications
Year:
2005

Citing 7
Cited 0

Constructing attack scenarios through correlation of intrusion alerts

Proceedings of the 9th ACM conference on Computer and communications security
Probabilistic Alert Correlation

RAID '00 Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection
Alert Correlation in a Cooperative Intrusion Detection Framework

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Managing Alerts in a Multi-Intrusion Detection Environment

ACSAC '01 Proceedings of the 17th Annual Computer Security Applications Conference
Mining Alarm Clusters to Improve Alarm Handling Efficiency

ACSAC '01 Proceedings of the 17th Annual Computer Security Applications Conference
A mission-impact-based approach to INFOSEC alarm correlation

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
M2D2: a formal data model for IDS alert correlation

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

Intrusion detection systems are used to alert system administrators to malicious attacks. Unfortunately, running without any information of the network resources that they protect, intrusion detection systems are notorious for generating a large number of alerts that are either not related to malicious activity or not representative of a successful attack. To address this shortcoming, this paper presents a vulnerability-driven active alert verification approach that performs real-time verification of attacks detected by an intrusion detection system. By means of checking for the vulnerability that the attack attempts to exploit, we can verify whether the attack has succeeded or not. The Experimental evaluation illustrates that it is a useful tool for reducing the false positive rate.