A hierarchical security event correlation model for real-time threat detection and response

Maosa, Herbert, Ouazzane, Karim and Ghanem, Mohamed Chahine (2024) A hierarchical security event correlation model for real-time threat detection and response. Network, 4 (1). pp. 68-90. ISSN 2673-8732

This is the latest version of this item.

network-04-00004.pdf - Published Version
Available under License Creative Commons Attribution 4.0.

Download (712kB) | Preview
Official URL: https://www.mdpi.com/2673-8732/4/1/4

Abstract / Description

An Intrusion detection system (IDS) performs post-compromise detection of security breaches whenever preventive measures such as firewalls do not avert an attack. However, these systems raise a vast number of alerts that must be analyzed and triaged by security analysts. This process is largely manual, tedious and time-consuming. Alert correlation is a technique that reduces the number of intrusion alerts by aggregating alerts that are similar in some way. However, the correlation is performed outside the IDS through third-party systems and tools, the IDS has already generated a high volume of alerts. These third-party systems add to the complexity of security operations. In this paper, we build on the highly researched area of alert and event correlation by developing a novel hierarchical event correlation model that promises to reduce the number of alerts issued by an Intrusion Detection System. This is achieved by correlating the events before the IDS classifies them. The proposed model takes the best of features from similarity and graph-based correlation techniques to deliver an ensemble capability not possible by either approach separately. Further, we propose a correlation process for events rather than alerts as is the case in current art. We further develop our own correlation and clustering algorithm which is tailor-made to the correlation and clustering of network event data. The model is implemented as a proof of concept with experiments run on standard Intrusion detection sets. The correlation achieved 87% data reduction through aggregation, producing nearly 21,000 clusters in about 30 seconds.

Item Type: Article
Uncontrolled Keywords: event correlation; similarity-based correlation; graph-based correlation; association rule mining; correlation model; hierarchical correlation; event correlation process
Subjects: 000 Computer science, information & general works
Department: School of Computing and Digital Media
Depositing User: Mohamed Ghanem
Date Deposited: 12 Feb 2024 10:24
Last Modified: 12 Feb 2024 10:24
URI: https://repository.londonmet.ac.uk/id/eprint/9143

Available Versions of this Item

  • A hierarchical security event correlation model for real-time threat detection and response. (deposited 12 Feb 2024 10:24) [Currently Displayed]


Downloads per month over past year

Downloads each year

Actions (login required)

View Item View Item