Processing Intrusion Detection Alert Aggregates with Time Series Modeling - CentraleSupélec Access content directly
Journal Articles Information Fusion Year : 2009

Processing Intrusion Detection Alert Aggregates with Time Series Modeling

Jouni Viinikka
  • Function : Author
Hervé Debar
Ludovic Mé
  • Function : Author
  • PersonId : 4609
  • IdHAL : lme
  • IdRef : 075014459
Anssi Lehikoinen
  • Function : Author
Mika Tarvainen
  • Function : Author


Abstract: The main use of intrusion detection systems (IDS) is to detect attacks against information systems and networks. Normal use of the network and its functioning can also be monitored with an IDS. It can be used to control, for example, the use of management and signaling protocols, or the network traffic related to some less critical aspects of system policies. These complementary usages can generate large numbers of alerts, but still, in operational environment, the collection of such data may be mandated by the security policy. Processing this type of alerts presents a different problem than correlating alerts directly related to attacks or filtering incorrectly issued alerts. We aggregate individual alerts to alert flows, and then process the flows instead of individual alerts for two reasons. First, this is necessary to cope with the large quantity of alerts - a common problem among all alert correlation approaches. Second, individual alert's relevancy is often indeterminable, but irrelevant alerts and interesting phenomena can be identified at the flow level. This is the particularity of the alerts created by the complementary uses of IDSes. Flows consisting of alerts related to normal system behavior can contain strong regularities. We propose to model these regularities using non-stationary autoregressive models. Once modeled, the regularities can be filtered out to relieve the security operator from manual analysis of true, but low impact alerts. We present experimental results using these models to process voluminous alert flows from an operational network.
No file

Dates and versions

hal-00353056 , version 1 (14-01-2009)


  • HAL Id : hal-00353056 , version 1


Jouni Viinikka, Hervé Debar, Ludovic Mé, Anssi Lehikoinen, Mika Tarvainen. Processing Intrusion Detection Alert Aggregates with Time Series Modeling. Information Fusion, 2009, 10 (4), pp.312-324. ⟨hal-00353056⟩
101 View
0 Download


Gmail Facebook X LinkedIn More