Assessment of an Automatic Correlation Rules Generator - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2015

Assessment of an Automatic Correlation Rules Generator


Information systems are prone to attacks. Those attacks can take different forms, from an obvious DDOS to a complex attack sce- nario involving a step by step stealthy compromise of key nodes in the target system. In order to detect those multi-steps attack scenarios, alert correlation systems are required. Those systems rely on explicit or im- plicit correlation rules in order to detect complex links between various events or alerts produced by IDSes. Explicit and accurate correlation rules strongly linked with the system are difficult to build and maintain manually. However this process can be partially automated when enough information on the attack scenario and the target system are available. In this paper, we focus on the evaluation of correlation rules produced by an automatic process. In a first place, the method is evaluated on a representative system. In this realistic evaluation context, when the knowledge of both the attack scenario and the targeted system is precise enough, the generated rules allow to have a perfect detection rate (no false positive and no false negative). Then stress tests are conducted in order to measure the robustness of the approach when the generation of rules relies on a provided knowledge which is either partially incorrect or incomplete.
No file

Dates and versions

hal-01241810 , version 1 (11-12-2015)



Erwan Godefroy, Eric Totel, Michel Hurfin, Frédéric Majorczyk. Assessment of an Automatic Correlation Rules Generator. 11th International Conference on Information Systems Security (ICISS 2015), Dec 2015, Kolkata, India. ⟨10.1007/978-3-319-26961-0_13⟩. ⟨hal-01241810⟩
232 View
0 Download



Gmail Facebook X LinkedIn More