Using Alert Verification to Identify Successful Intrusion Attempts
-
C. Kruegel
ABSTRACT
Intrusion detection systems monitor protected networks and attempt to identify evidence of malicious activity. When an attack is detected, an alert is produced, and, possibly, a countermeasure is executed. A perfect intrusion detection system would be able to identify all the attacks without raising any false alarms. In addition, a countermeasure would be executed only when an attack is actually successful. Unfortunately false alarms are commonplace in intrusion detection systems, and perfectly benign events are interpreted as malicious. In addition, non-relevant alerts are also common. These are alerts associated with attacks that were not successful. Such alerts should be tagged appropriately so that their priority can be lowered.
The process of identifying alerts associated with successful attacks is called alert verification. This paper describes the different issues involved in alert verification and presents a tool that performs real-time verification of attacks detected by an intrusion detection system. The experimental evaluation of the tool shows that verification can dramatically reduce both false and non-relevant alerts.
© Copyright by K.G. Saur Verlag 2004
Articles in the same Issue
- Reactive Security – Intrusion Detection, Honeypots, and Vulnerability Assessment
- Honeynet Operation within the German Research Network – A Case Study
- Vulnerability Assessment using Honeypots
- A Network of IDS Sensors for Attack Statistics
- Foundations for Intrusion Prevention
- Using Alert Verification to Identify Successful Intrusion Attempts
- Intrusion Detection in Unlabeled Data with Quarter-sphere Support Vector Machines
- Trust-Based Monitoring of Component-Structured Software
- Linux Diskless Clients – Festplattenlose Systeme für den Kursraumbetrieb
- Alois Potton hat das Wort
Articles in the same Issue
- Reactive Security – Intrusion Detection, Honeypots, and Vulnerability Assessment
- Honeynet Operation within the German Research Network – A Case Study
- Vulnerability Assessment using Honeypots
- A Network of IDS Sensors for Attack Statistics
- Foundations for Intrusion Prevention
- Using Alert Verification to Identify Successful Intrusion Attempts
- Intrusion Detection in Unlabeled Data with Quarter-sphere Support Vector Machines
- Trust-Based Monitoring of Component-Structured Software
- Linux Diskless Clients – Festplattenlose Systeme für den Kursraumbetrieb
- Alois Potton hat das Wort
