A Scalable and Efficient Correlation Engine to Detect Multi-step Attacks in Distributed Systems - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2018

A Scalable and Efficient Correlation Engine to Detect Multi-step Attacks in Distributed Systems

Un moteur de corrélation efficace et qui passe à l'échelle pour détecter des attaques en plusieurs étapes dans des systèmes distribués

Résumé

In distributed systems and in particular in industrial SCADA environments, alert correlation systems are necessary to identify complex multi-step attacks within the huge amount of alerts and events. In this paper we describe an automata-based correlation engine developed in the context of a European project where the main stakeholder was an energy distribution company. The behavior of the engine is extended to fit new requirements. In the proposed solution, a fully automated process generates thousands of correlation rules. Despite this major scalability challenge, the designed correlation engine exhibits good performances. Expected rates of incoming low level alerts approaching several hundreds of elements per second are tolerated. Moreover, the used data structures allow to quickly handle dynamic changes of the set of correlation rules. As some attack steps are not observed, the correlation engine can be tuned to raise an alert when all the attack steps except k of them have been detected. To be able to react to an ongoing attack by taking countermeasures, alerts must also be raised as soon as a significant prefix of an attack scenario is recognized. Fulfilling these additional requirements leads to increase the memory consumption. Therefore purge mechanisms are also proposed and analyzed. An evaluation of the tool is conducted in the context of a SCADA environment.
Fichier principal
Vignette du fichier
Hal-SRDS-2018.pdf (431.33 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01949183 , version 1 (09-12-2018)

Identifiants

Citer

David Lanoe, Michel Hurfin, Eric Totel. A Scalable and Efficient Correlation Engine to Detect Multi-step Attacks in Distributed Systems. SRDS 2018 - 37th IEEE International Symposium on Reliable Distributed Systems, Oct 2018, Salvador, Brazil. pp.1-10, ⟨10.1109/srds.2018.00014⟩. ⟨hal-01949183⟩
112 Consultations
480 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More