Download - Academy Publisher

example, changes and even slight divergence form the
basic part of the flow can be revealed by it.
sponsored by Natural Science Foundation of Hubei
Province under Grant No. 2008CDA021.
REFERENCES
Fig.3 Case 2 for ICMP L3retriever Ping flow: (a) Original alarm flow
series (dotted line) and SSA-reconstructed series (continuous line)
corresponding to normal flow behavior. (b) Residual series defined as
the difference between the original and reconstructed series.
IV. CONCLUSIONS
Network threat identification and evaluation aims to
extract knowledge of current security threat and status
from raw security data. In practice, identifying the
security incidents of true threat from IDS alarms is really
difficult because the amount of alarms is usually
overwhelming and there are a lot of redundant and false
alarms. In this paper we focus processing aggregated
alarm flow in real-time. Using the SSA, we first explore
the intrinsic dimensionality and structure of the timeseries
corresponding to alarm flow. Then we capture the
leading components, which represent the main part of the
flow, to make threat evaluation. Reconstructed signals
enable the administrator to have a real-time view of
security threat situation. In addition, the threat evaluation
can work well in dynamic and non-stationary network
environment. Based on the approach, we do not need to
know the parametric model of the considered time series
and have the ability to autonomously adapt to shifts in the
structure of the alarm flow. We believe that the method
could be used as such, or in complement to other means
of correlation, to monitor alarms. In the next work, we
plan to focus on automatically detecting changes in alarm
flow and further improve our threat evaluation approach.
ACKNOWLEDGMENT
This work is supported by the National Natural Science
Foundation of China under Grant No. 60573120, and by
the National High Technology Research and
Development Program of China (863 Program) under
Grant No. 2007AA01Z420, and by the key project
[1] J. Allen, A. Christie, et al., (2007) State of the Practice of
Intrusion Detection Technologies. Available via Software
Engineering
Institute.
http://www.sei.cmu.edu/publications/documents/99.reports
/99tr028/99tr028abstract.html.
[2] P. Ning, Y. Cui, and D. S. Reeves: Constructing attack
scenarios through correlation of intrusion alerts. In
Proceedings of the 9th ACM Conference on Computer and
Communications Security, Nov 18-22 2002, Washington,
DC, United States, 2002.
[3] P. Ning, Y. Cui, D. S. Reeves, and D. Xu: Techniques and
tools for analyzing intrusion alerts. In: ACM Transactions
on Information and System Security, vol. 7, pp.274, 2004.
[4] W. Lee, S. J. Stolfo, A Framework for Constructing
Features and Models for Intrusion Detection Systems,
ACM Transactions on Information and System Security
3(4) (2000) 227–261
[5] X. Qin and W. Lee. Statistical Causality Analysis of
INFOSEC Alert Data. In Proc. of the RAID’03, Springer–
Verlag, 2003.
[6] F. Cuppens.: Managing alerts in multi-intrusion detection
environment. In: Proceedings 17th annual computer
security applications conference. New Orleans; 2001.
[7] F. Cuppens, A. Miege: Alert correlation in a cooperative
intrusion detection framework. In: Proceedings of the 2002
IEEE symposium on security and privacy; 2002.
[8] K. Julisch and M. Dacier. Mining Intrusion Detection
Alarms for Actionable Knowledge. In Proc. of the
SIGKDD’02, 2002.
[9] C. Kruegel and W. Robertson. Alert verification:
Determining the success of intrusion attempts. In Proc. of
the DIMVA’06, Dortmund, Germany, July 2006.
[10] P. Ammann, D. Wijesekera, and S. Kaushik, Scalable,
Graph-Based Network Vulnerability Analysis, Proceedings
of the 9th ACM Conference on Computer and
Communications Security, New York: ACM Press, 2002,
217–224
[11] R. Ritchey and P. Amman, Using Model Checking to
Analyze Network Vulnerabilities, Proceedings of the 2000
IEEE Symposium on Security and Privacy, pp. 156-165,
2000
[12] A. Gehani, G. Kedem Rheostat: Real-time Risk
Management. In Proceedings of the 7th International
Symposium on Recent Advances in Intrusion Detection,
2004.
[13] A. Arnes, F. Valeur, G.. Vigna., R. A. Kemmerer,Using
Hidden Markov Models to Evaluate the Risk of Intrusions.
in: Proceedings of the International Symposium on the
Recent Advances in Intrusion Detection(RAID 2006):
Springer-Verlag, 2006. 145-164.
[14] N. Nekrutkin, V. Zhigljavsky, 2001. Analysis of Time
Series Structure—SSA and Related Techniques. Chapman
& Hall/CRC, Boca Raton, FL, pp. 13-78.
[15] Vautard, R., Yiou, P., Ghil, M. Singular-spectrum analysis :
a toolkit for short, noisy chaotic signals. Physica D, vol. 58,
pp. 95-126, 1992.
[16] B. Caswell, M. Roesch (2004) Snort: The open source
network intrusion detection system. Available via Snort.
http://www.snort.org/
96