Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances

We map intrusion events to known exploits in the network attack graph, and correlate the events through the corresponding attack graph distances. From this, we construct attack scenarios, and provide scores for the degree of causal correlation between their constituent events, as well as an overall relevancy score for each scenario. While intrusion event correlation and attack scenario construction have been previously studied, this is the first treatment based on association with network attack graphs. We handle missed detections through the analysis of network vulnerability dependencies, unlike previous approaches that infer hypothetical attacks. In particular, we quantify lack of knowledge through attack graph distance. We show that low-pass signal filtering of event correlation sequences improves results in the face of erroneous detections. We also show how a correlation threshold can be applied for creating strongly correlated attack scenarios. Our model is highly efficient, with...

• Type: Conference
• Year: 2004
• Where: ACSAC
• Authors: Steven Noel, Eric Robertson, Sushil Jajodia
• Keywords: ACSAC 2004, Attack Graph Distance, Attack Graphs, Attack Scenarios, Security Privacy