An alert correlation approach based on security operator's knowledge and preferences

Journal of Applied Non-Classical Logics 20 (1-2):7-37 (2010)
  Copy   BIBTEX

Abstract

One of the major problems of intrusion detection concerns the large amount of alerts that intrusion detection systems (IDS) produce. Security operator who analyzes alerts and takes decisions, is often submerged by the high number of alerts to analyze. In this paper, we present a new alert correlation approach based on knowledge and preferences of security operators. This approach, which is complementary to existing ones, allows to rank-order produced alerts on the basis of a security operator knowledge about the system, used IDS and his preferences about alerts that he wants to analyze or to ignore. Our approach is based on the development of a new non-classical logic for representing preferences, called FO-MQCL (First Order - Minimal Qualitative Choice Logic). Our logic extends a fragment of the first order logic by adding a new logical connective. The general idea is to present only alerts that fully fit security operator's preferences and knowledge. And if needed, less preferred alerts can also be presented.

Links

PhilArchive



    Upload a copy of this work     Papers currently archived: 93,642

External links

Setup an account with your affiliations in order to access resources via your University's proxy server

Through your library

Similar books and articles

Dynamic logic of preference upgrade.Johan van Benthem & Fenrong Liu - 2007 - Journal of Applied Non-Classical Logics 17 (2):157-182.
Knowledge assimilation in domains of actions: a possible causes approach.Renwei Li & Luís Moniz Pereira - 1997 - Journal of Applied Non-Classical Logics 7 (1-2):77-116.

Analytics

Added to PP
2013-12-19

Downloads
4 (#1,644,260)

6 months
17 (#161,763)

Historical graph of downloads
How can I increase my downloads?

Citations of this work

No citations found.

Add more citations

References found in this work

Qualitative choice logic.Gerhard Brewka, Salem Benferhat & Daniel Le Berre - 2004 - Artificial Intelligence 157 (1-2):203-237.

Add more references