Authors:
Salem Benferhat
and
Karima Sedki
Affiliation:
CRIL-CNRS UMR-8188, Universit d’Artois, France
Keyword(s):
Alert correlation, preferences logic, administrator’s preferences and knowledge.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Intrusion Detection & Prevention
Abstract:
Intrusion detection systems (IDSs) are important tools for infortation systems security. However, they generate a large number of alerts which complicate the task of network administrator to understand these triggered alerts and take appropriate actions. In this paper, we present a logic-based approach to alert correlation. This logic allows to integrate administrator’s preferences and knowledge. Our logic, called Extended Qualitative Choice Logic
(E Q C L ), is an extension of a fragment of first order logic. It adds a new connector, denoted →X that allows to represent administrator preferences. The objective of our logic-based alert correlation approach is to rank-order alerts generated by IDS on the basis of administrator preferences and knowledge. Only alerts that fully fit administrator’s preferences and knowledge are first presented. Then if needed, less preferred alerts (which falsify less important preferences) will be presented, and so on.