Network Security White Papers
Enriching Intrusion Alerts Through Multi-Host Causality
Overview Current intrusion detection systems point out suspicious states or events but do not show how the suspicious state or events relate to other states or events in the system. This paper shows how to enrich an IDS alert with information about how those alerts causally lead to or result from other events in the system. By enriching IDS alerts with this type of causal information, one can leverage existing IDS alerts to learn more about the suspected attack. Backward causal graphs can be used to find which host allowed a multi-hop attack (such as a worm) to enter a local network; forward causal graphs can be used to find the other hosts that were affected by the multi-hop attack.
| Publisher | University of Michigan | File Format | |
|---|---|---|---|
| Date Published | January 2008 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 2 out of 3 users found this white paper useful
White Paper RSS
Download
Register
