Integrating Alerts From Multiple Homogeneous Intrusion Detection Systems

Abstract

Intrusion Detection is a relatively young area of research, begun in the early 1980's. Currently most intrusion detection systems (IDSs) produce a large number of alerts based on low level attacks or anomalies. More distressing is that a large number of alerts are false positives. The false alert rate becomes even more important as networks become larger. Effectively monitoring a large network requires the deployment of multiple intrusion detection systems at key points on the network. Yet, this deployment increases the number of alerts that administrators must attend to. In addition, since most IDSs produce alerts based on low-level attacks, they give no indication about the relationship between alerts.

In this work, we describe a method for correlating intrusion alerts from low level alerts produced by multiple homogenous IDSs. Our technique extends the intrusion alert correlation technique developed at North Carolina State University, which uses an intrusion alert's prerequisites and consequences to construct high-level attack scenarios. The prerequisite of an alert specifies what must be true in order for the corresponding attack to be successful, and the consequences describe what can possibly be true if the attack succeeds. The extended technique relaxes the temporal constrains on alert from different IDSs to account for any possible timestamp inconsistencies (due to network delays, lack of system clock synchronization, host workload).

Our correlation method reduces alert volume, and improves performance with reduction in false positives compared to uncorrelated alerts. Our correlation of alerts from multiple intrusion systems provides for an automated method to show not only the relationship between alerts from one IDS, but also the relationships between alerts from different IDSs. Therefore, our method gives a more complete view of attack scenarios.