TY  - JOUR
A1  - Roschke, Sebastian
A1  - Cheng, Feng
A1  - Meinel, Christoph
T1  - An alert correlation platform for memory-supported techniques
T2  - Concurrency and computation : practice & experience
N2  - Intrusion Detection Systems (IDS) have been widely deployed in practice for detecting malicious behavior on network communication and hosts. False-positive alerts are a popular problem for most IDS approaches. The solution to address this problem is to enhance the detection process by correlation and clustering of alerts. To meet the practical requirements, this process needs to be finished fast, which is a challenging task as the amount of alerts in large-scale IDS deployments is significantly high. We identifytextitdata storage and processing algorithms to be the most important factors influencing the performance of clustering and correlation. We propose and implement a highly efficient alert correlation platform. For storage, a column-based database, an In-Memory alert storage, and memory-based index tables lead to significant improvements of the performance. For processing, algorithms are designed and implemented which are optimized for In-Memory databases, e.g. an attack graph-based correlation algorithm. The platform can be distributed over multiple processing units to share memory and processing power. A standardized interface is designed to provide a unified view of result reports for end users. The efficiency of the platform is tested by practical experiments with several alert storage approaches, multiple algorithms, as well as a local and a distributed deployment.
KW  - memory-based correlation
KW  - memory-based clustering
KW  - memory-based databases
KW  - IDS management
Y1  - 2012
UR  - https://publishup.uni-potsdam.de/frontdoor/index/index/docId/35808
SN  - 1532-0626
VL  - 24
IS  - 10
SP  - 1123
EP  - 1136
PB  - Wiley-Blackwell
CY  - Hoboken
ER  -