Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts
Abdel Ghafar, I., Taha, A., Bahaa Eldin, A., Mahdi, H. (2010). Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts. EKB Journal Management System, 7(7th International Conference on Electrical Engineering ICEENG 2010), 1-13. doi: 10.21608/iceeng.2010.33007
Ismail Abdel Ghafar; Ayman E. Taha; Ayman M. Bahaa Eldin; Hani M. K. Mahdi. "Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts". EKB Journal Management System, 7, 7th International Conference on Electrical Engineering ICEENG 2010, 2010, 1-13. doi: 10.21608/iceeng.2010.33007
Abdel Ghafar, I., Taha, A., Bahaa Eldin, A., Mahdi, H. (2010). 'Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts', EKB Journal Management System, 7(7th International Conference on Electrical Engineering ICEENG 2010), pp. 1-13. doi: 10.21608/iceeng.2010.33007
Abdel Ghafar, I., Taha, A., Bahaa Eldin, A., Mahdi, H. Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts. EKB Journal Management System, 2010; 7(7th International Conference on Electrical Engineering ICEENG 2010): 1-13. doi: 10.21608/iceeng.2010.33007

Towards Implementing Agent Based Correlation Model For Real-Time Intrusion Detection Alerts

The International Conference on Electrical Engineering
Article 48, Volume 7, 7th International Conference on Electrical Engineering ICEENG 2010, May 2010, Page 1-13  XML PDF (889.35 K)
Document Type: Original Article
DOI: 10.21608/iceeng.2010.33007
View on SCiNiTO View on SCiNiTO
Authors
Ismail Abdel Ghafar1; Ayman E. Taha1; Ayman M. Bahaa Eldin2; Hani M. K. Mahdi2
1Egyptian Armed Forces.
2Computer and Systems Engineering Department, College of Engineering, Ain Shams University, Abasia, Cairo, Egypt.
Abstract
Abstract:
Alert correlation is a promising technique in intrusion detection. It analyzes the alerts
from one or more intrusion detection system and provides a compact summarized
report and high-level view of attempted intrusions which highly improves security
effectiveness. Correlation component is a procedure which aggregates alerts
according to certain criteria. The aggregated alerts could have common features or
represent steps of pre-defined scenario attacks. Correlation approaches composed of
a single component or a comprehensive set of components. The effectiveness of a
component depends heavily on the nature of the real alerts or the dataset analyzed.
The order of correlation components affects the correlation process performance.
Moreover not all components should be used for different dataset. This paper
presents implementation of an Agent Based Correlation Model for real-time intrusion
detection alerts. Learning agent learns the nature of alerts within a network then
guides the whole correlation process and components in such a suitable way of which
components could be used and in which order. The model improves the performance
of correlation process by selecting the proper components to be used. The simulation
results showed that ABCM model assures minimum alerts to be processed on each
component depending on the dataset and minimum time for correlation process.
Keywords
Alert Correlation; Intrusion Detection; Learning Agent; Agent-Based Systems
Statistics
Article View: 96
PDF Download: 208