Loading...
Send to Friend
 Bookmark
 Review List
  1. HAL-RD: Cross-correlating heterogeneous alerts and logs using resource dependencies

HAL-RD: Cross-correlating heterogeneous alerts and logs using resource dependencies

Safarzadeh, M ; Sharif University of Technology | 2020

507 Viewed
  1. Type of Document: Article
  2. DOI: 10.1145/3341105.3373911
  3. Publisher: Association for Computing Machinery , 2020
  4. Abstract:
  5. Many organizations today use a variety of security and monitoring tools at various levels of defense. These tools often generate heterogeneous alerts and logs when an attack occurs. Because of the large volume and dispersion of these alerts and logs, the manual cross-correlation of them is a time-consuming and labor-intensive task. The main challenge is that heterogeneous alerts and logs generated as a result of an attack stage do not necessarily have common features, or there are no explicit relationships between them that can be used for cross-correlation. In this paper, we overcome this deficiency by presenting HAL-RD, a novel technique that uses resource dependencies to cross-correlate heterogeneous alerts and logs. In this technique, we track logs for backward and forward dependencies between resources. This information is then used to construct an attack state graph, which is a directed graph whose nodes represent attack states and whose directed edges represent the chronological ordering between them. Each attack state integrates information found in multiple heterogeneous alerts, logs, and OS-level operations, which relate to one stage in a multi-stage attack. In certain circumstances, the attack state graph is incrementally updated. By doing this, when an attacker continues his/her multi-stage attack after a delay, all of his/her activities are identified. The evaluation results demonstrate the effectiveness of HAL-RD for cross-correlating heterogeneous alerts and logs. © 2020 ACM
  6. Keywords:
  7. Alert correlation ; Alert enrichment ; Attack state graph ; Cross-correlation ; Heterogeneous alerts and logs ; Computation theory ; Chronological order ; Cross correlations ; Evaluation results ; Multi-stage attack ; Novel techniques ; Resource dependencies ; Security and monitoring ; Directed graphs
  8. Source: 35th Annual ACM Symposium on Applied Computing, SAC 2020, 30 March 2020 through 3 April 2020 ; 2020 , Pages 1726-1735
  9. URL: https://dl.acm.org/doi/abs/10.1145/3341105.3373911