使用类型图实时的警报关联
Real-Time Alert Correlation with Type Graphs
摘要：
自动警报关联的前提是接受来自低级别入侵检测系统的错误警报是不可避免的，并使用攻击模型以可理解的方式解释输出。为此目的存在几种算法，它们使用攻击图来模拟攻击可以组合的方式。这些算法可以分为两大类，即基于脆弱性评估和依赖于攻击类型之间关系的抽象模型的类型图方法，创建攻击模型的神经网络图方法。一些研究在提高效率的类型图的相关性已经进行，但这些研究都忽略了假设丢失的警报。我们的工作是提出一种新的类型图算法，它统一的相关性和假设在一个单一的操作。我们的实验结果表明，该方法是非常有效的，在面对密集的警报，并产生紧凑的输出图相比，其他技术。
英文摘要：
The premise of automated alert correlation is to accept that false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which attacks can be combined. These algorithms can be classified in to two broad categories namely scenario-graph approaches, which create an attack model starting from a vulnerability assessment and type-graph approaches which rely on an abstract model of the relations between attack types. Some research in to improving the efficiency of type-graph correlation has been carried out but this research has ignored the hypothesizing of missing alerts. Our work is to present a novel type-graph algorithm which unifies correlation and hypothesizing in to a single operation. Our experimental results indicate that the approach is extremely efficient in the face of intensive alerts and produces compact output graphs comparable to other techniques.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
