Searching for just a few words should be enough to get started. If you need to make more complex queries, use the tips below to guide you.
Article type: Research Article
Authors: Bouzar-Benlabiod, Lydiaa; * | Benferhat, Salemb | Bouabana-Tebibel, Thourayaa
Affiliations: [a] LCSI Laboratory, Ecole Nationale Supérieure d'Informatique, Algiers, Algeria | [b] CRIL-CNRS, Université d'Artois, Lens, France
Correspondence: [*] Corresponding author: Lydia Bouzar-Benlabiod, LCSI Laboratory, Ecole Nationale Supérieure d'Informatique (ESI), Algiers, Algeria. E-mail: l_bouzar@esi.dz.
Abstract: Intrusion Detection Systems (IDS) are necessary and important tools for monitoring information systems. However they produce a huge quantity of alerts. Alerts correlation is a process that reduces the number of alerts reported by intrusion detection systems. In this paper, we propose a new algorithm for a logical-based alerts correlation approach that integrates: security operator's knowledge and preferences. The representation and the reasoning on these knowledge and preferences are done using a new logic called Instantiated First Order Qualitative Choice Logic (IFO-QCL). Our modeling views an alert as an interpretation which allows us to have an efficient algorithm that performs the correlation process in a polynomial time. This paper also provides experimental results which are achieved on datasets issued from a real monitoring system.
Keywords: IDS, alerts correlation, QCL, preferences bases, knowledge bases
DOI: 10.3233/IDA-140693
Journal: Intelligent Data Analysis, vol. 19, no. 1, pp. 3-27, 2015
IOS Press, Inc.
6751 Tepper Drive
Clifton, VA 20124
USA
Tel: +1 703 830 6300
Fax: +1 703 830 2300
sales@iospress.com
For editorial issues, like the status of your submitted paper or proposals, write to editorial@iospress.nl
IOS Press
Nieuwe Hemweg 6B
1013 BG Amsterdam
The Netherlands
Tel: +31 20 688 3355
Fax: +31 20 687 0091
info@iospress.nl
For editorial issues, permissions, book requests, submissions and proceedings, contact the Amsterdam office info@iospress.nl
Inspirees International (China Office)
Ciyunsi Beili 207(CapitaLand), Bld 1, 7-901
100025, Beijing
China
Free service line: 400 661 8717
Fax: +86 10 8446 7947
china@iospress.cn
For editorial issues, like the status of your submitted paper or proposals, write to editorial@iospress.nl
如果您在出版方面需要帮助或有任何建, 件至: editorial@iospress.nl