1. Alert Correlation for Extracting Attack Strategies Authors: B. Zhu and A. A. Ghorbani Source: IJNS review paper Reporter: Chun-Ta Li ( 李俊達 )

2. 2 Outline  Introduction  Proposed approach  Test and evaluation  Conclusions and future work  Comments

3. 3 Introduction (1/2)  Security issues The number of incidents rapidly increased from 82,094 in 2002 to 137,529 in 2003. Attacks are getting more and more sophisticated. One of the solutions: Intrusion detection systems (IDS)  Intrusion detection systems Host-based and network-based (data source) Problems:  Understanding of attack behaviors  Extracting attack strategies from the alerts Manually managing, time-consuming and error-prone

4. 4 Introduction (2/2)  Alert correlation techniques Alert Correlation Based on Feature Similarity  Based on the similarities of some selected features  Ex. Source IP address, target IP address, and port number  Drawback: Cannot discover the causal relationships between related alerts Alert Correlation Based on Known Scenario  Learned from training datasets using data mining approach  It can uncover the causal relationship of alerts  Drawback: They are all restricted to known situations Alert Correlation Based on Prerequisite and Consequence Relationship  Most alerts are not isolated, but related to different stages of attacks  Drawback: It cannot correlated unknown attacks

5. 5 Proposed approach (1/9)  Overview To reveal the causal relationship among the alerts Automated construction of attack graphs Alert Alert Correlation Matrix (ACM) n alerts n n 1. Multi-Layer Perceptron (MLP) 2. Support Vector Machine (SVM) ▪ Whether or not two alerts should be correlated ▪ If yes, the probability with which they are correlated A group of the correlated alerts Algorithm 1 A list of hyper-alerts Algorithm 2 Attack graph (Causal relationship among alerts) Correlation engine

6. 6 Proposed approach (2/9)  Alert Correlation Matrix (ACM) Cell: (temporal relationship) Each cell in ACM holds a correlation weight: Correlation Strength (Π)  Backward Correlation Strength (Π b )  Forward Correlation Strength (Π f ) Current alert Next alert Previous alert ΠbΠb ΠfΠf ΠfΠf ΠbΠb n n

7. 7 Proposed approach (3/9)  Feature selection Alert information: timestamp, source IP, destination IP, source port, destination port, type of the attack 6 features:   0 or 1   between 0 or 1 ▪ The value of F6 is low  two alerts are seldom correlated (Π b is not reliable) ▪ The value of F6 becomes large  two alerts are frequently correlated (Π b is reliable)

8. 8 Proposed approach (4/9)  Alert Correlation Using Multi-Layer Perceptron (MLP) Inputs: 6 elements and label Outputs: a value between 0 and 1 (the probability that two alerts are correlated)  Alert Correlation Using Support Vector Machine (SVM) Inputs: the same input used for MLP and bipolar format labels Outputs: a value between 0 and 1 -- The output of the conventional SVM (not probability) -- The probability output of SVM [Platt, 1999] -- cross-entropy error function [Platt, 1999]

9. Proposed approach (5/9)  Comparison of MLP and SVM MLP:  More accurate than SVM  Slow training speed  Over-fitting problem SVM:  To produce precise probabilistic output  selected appropriate training patterns // To make a decision based on the outputs of both of these two methods //

10. 10 Proposed approach (6/9)  Correlation process (Algorithm 1) Construct the hyper-alert graph  To give the network administrator intrinsic view of attack scenarios  Two thresholds: correlation threshold and correlation sensitivity

11. 11  0.5

12. 12 Proposed approach (8/9)  Generating Attack Graph using ACM (Algorithm 2) To represent different typical attack strategies hyper-alert graph vs. attack graph  Attack graph (it can have cycles), hyper-alert graph (no cycles)  Attack graphs are a more general representations of attack strategies  Encodes causal relationship among alerts The algorithm performs a horizontal search (Π f ) in the ACM

13. 13

14. 14 Test and evaluation (1/7)  Experiment with DARPA 2000 Dataset [MIT Lincoln Laboratory] Two multistage attack scenarios: LLDOS1.0 and LLDOS2.0.2  Alert log file [RealSecure IDS] LLDOS1.0 (924 alerts)  Correlation process correlation threshold r = 0.5 correlation sensitivity s = 0.1  ACM contains 19 different types of alerts LLDOS2.0.2 (494 alerts)  Correlation process correlation threshold r = 0.5 correlation sensitivity s = 0.1  ACM contains 17 different types of alerts

15. 15

16. 16 Test and evaluation (3/7)  LLDOS 1.0 – Scenario One

17. 17 Test and evaluation (4/7)

18. 18 Test and evaluation (5/7)  LLDOS 2.0.2 – Scenario Two

19. 19 Test and evaluation (6/7)

20. 20 Test and evaluation (7/7)  The attack strategies from intrusion alerts is similar to Ning et al. [Ning and Xu, 2003]  The difference is that the proposed approach does not need to define a large number of rules in order to correlate the alerts.  The ACS is adaptive to the emerge of new attack patterns because new alerts are automatically added to the ACM.

21. 21 Conclusions and future work  This paper presents an alert correlation technique Multilayer Perceptron (MLP) Support Vector Machine (SVM) Alert Correlation Matrix (ACM) Automatic extracting attack strategies from alerts  Future work Identifying more features for correlation Real-time correlation Recognizing the variations of attack strategies Target recognition and risk assessment

22. 22 Comments  In this paper, the authors would like to propose a new alert correlation technique that can automatically extract attack strategies from a large number of intrusion alerts for the administrator to study new countermeasures. There are two neural network approaches is used to determine the causal relationship of two alerts, including Multilayer Perceptron (MLP) and Support Vector Machine (SVM). Moreover, an Alert Correlation Matrix (ACM) is used to process and update the correlation strength of any two types of alerts. From the evaluation results on the DARPA 2000 dataset shows, the result of author ’ s approach is similar to previous research. The difference is that it does not need to define a large number of rules for the alerts and the new alerts can be automatically add to the ACM for studying new attack strategies.  My outlook More features The value of each label in MLP and SVM 18 training patterns SVM writing Efficiency and correlations  11 typos Evaluation of Paper: Good Recommendation: Accept after minor revision