Practical IDS alert correlation in the face of dynamic threats

A significant challenge in applying IDS alert correlation in today’s dynamic threat environment is the labor and experti s needed in constructing the correlation model, or the knowle dge base, for the correlation process. New IDS signatures captu ring emerging threats are generated on a daily basis, and the atta ck scenarios each captured activity may be involved in are also multitude. Thus it becomes hard to build and maintain IDS ale rt correlation models based on a set of known scenarios. Learni ng IDS correlation models face the same challenge caused by the dynamism of cyber threats, compounded by the inherent difficul ty in applying learning algorithms in an adversarial environm e t. We propose a new method for conducting alert correlation bas ed on a simple and direct semantic model for IDS alerts. The correlation model is separate from the semantic model and ca be constructed on various granularities. The semantic mode l only maps an alert to its potential meanings, without any referen ce to what types of attack scenarios the activity may be involved i n. We show that such a correlation model can effectively capture a ttack scenarios from data sets that are not used at all in the model construction process, illustrating the power of such corre lation methods in detecting novel, new attack scenarios. We rigoro usly evaluate our prototype on a number of publicly available dat a sets and a production system, and the result shows that our correl ation engine can correctly capture almost all the attack scenario s in the data sets.