Download - Academy Publisher

ISBN 978-952-5726-09-1 (Print)
Proceedings of the Second International Symposium on Networking and Network Security (ISNNS ’10)
Jinggangshan, P. R. China, 2-4, April. 2010, pp. 093-096
An Alarm Flow Decomposition Method for
Security Threat Evaluation
Jie Ma, and Zhitang Li
Computer Science Department,
Huazhong University of Science and Technology, Hubei Wuhan, China
mjhust@163.com
Abstract—How to analyze security alarms automatically and
find useful information form them has attract a lot of
interests. Although many alarm correlation approaches and
risk assessment methods have been proposed, most of them
were implemented with high computational complexity and
time consuming, and they can not deal well with huge
number of security alarms. This work focus on performing
an real-time security threat evaluation. We aggregate
individual alarms to alarm flows, and then process the flows
instead of individual alarms. Using the Singular Spectrum
Analysis (SSA) approach, we found that the alarm flow has
a small intrinsic dimension, and the alarm flow can be
decomposed into leading components and residual
components. Leading components represent the basic part
and residual components represent the noise part of the flow.
To capture the main features of the leading components
forming the alarm flow, we accomplish the security threat
evaluation. Case based experiments real network data
shows the effectiveness of the method. To the best of our
knowledge, this is the first study that applies SSA on the
analysis of IDS alarm flows.
Index Terms—alarm flow, threat evaluation, SSA
I. INTRODUCTION
Internet has become a mission-critical infrastructure
for governments, companies, institutions, and millions of
every-day users. Because of this significant increase
reliance on the Internet–based services, security and
survivability of networks has become a primary concern.
Intrusion Detection System (IDS) plays a vital role in the
overall security infrastructure, as one last defense against
attacks after secure network architecture design, secure
program design and firewalls [1]. It gathers information
form some key points in the computer networks, properly
analyzes it and detect violations of the monitored
system’s security policy. so as to extend the security
management capability of the system administrators and
improve the integrity of information security
infrastructure.
However, IDS are becoming unable to provide proper
analysis and effective defense mechanism. They often
report a massive number of elementary alarms of lowlevel
security-related events. Since be overwhelmed by
these alarms, administrators almost unable to make
proper security threat evaluations in real-time. For this
reason, some alarm correlation approaches were proposed.
Ning et al. developed a an intrusion alarm correlator [2][3]
to help human analysts to recognize multi-step attacks.
Lee et al. [4][5] built a framework based on data mining
techniques, such as sequential patterns mining and
episodes rules, to search causal relationships between
alarms to improve attack detection while maintaining a
low false positive rate. Cuppens [6][7] build alert
correlation systems based on matching the pre/postconditions
of individual alarms. The idea of the approach
is that prior attack steps prepare for later ones. Julisch
proposed to find alarm clusters and generalized forms of
false alarms to identify root causes [8][9], and those
alarms which are not possible attributed to the root causes
can be filtered out. Although these correlation approaches
enable to improve the alarm handling efficiency from
micro prospective, they are hard to work well with
massive security alarms and with large-scale network
environment.
Recently, some online security threat evaluation and
risk assessment methods have been developed. There are
approaches employing a graph-based representation of
systems [10][11], where an integrated, topological
approach to network vulnerability analysis is used. But,
these approaches usually follow a static procedure and
cannot meet the changes in a dynamic network
environment. Gehani [12] put forward a host-based
method for real-time risk assessment. The model
evaluates the threat probability from intrusion reports and
uses predetermined attack scenarios to calculate the risk.
Arnes [13] uses the Hidden Markov Model to compute
the probability of the security status of the system based
on observations from reporting of intrusion detection
sensors. However, there are several limitations faced by
these approaches. Since the high computational
complexity and time cost, these approaches are still can
not deal well with huge number of security alarms. In
addition, the models used in these approaches should be
retrained to adapt to new knowledge. Hence, it seems to
be inefficient in reducing the human workload.
The focus of our work is to perform the security threat
evaluation in real-time. Since IDS have the ability to
perform online attack detection and can dynamically
report security incidents which the network is suffering,
we chose IDS alarms as our processing objects and use
them to make threat evaluations. Different form the
approaches mentioned above, we use aggregated alarm
flows instead of individual alarms. We model the alarm
flow as a time series, which is a sequence of alarm
intensity observations i.e. the number of alarms in a
sampling interval as a time series. Only alarms generated
by the same IDS and with the same signature can be
© 2010 ACADEMY PUBLISHER
AP-PROC-CS-10CN006
93