@inproceedings{89430be608da4758a9dcecd301d1dea2,
title = "An alert fusion framework for situation awareness of coordinated multistage attacks",
abstract = "Recent incidents in the cyber world strongly suggest that coordinated multistage cyber attacks are quite feasible and that effective countermeasures need to be developed. Attack detection by correlation and fusion of intrusion alerts has been an active area of current research. However, most of these research efforts focus on ex post facto analysis of alert data to uncover related attacks. In this paper, we present an approach for dynamically calculating 'Scenario Credibilities' based on the state of a live intrusion alert stream. We also develop a framework for Attack Scenario representation that facilitates real-time fusion of intrusion alerts and calculation of the scenario credibility values. Our approach provides a usable mechanism for detecting, predicting and reasoning about multistage goal-oriented attacks in real time. The details of the fusion framework and a description of multistage attack detection using this framework are presented in this paper.",
keywords = "Alert correlation, Fusion, Intrusion detection, Multistage attacks, Situation awareness",
author = "Sunu Mathew and Chintan Shah and Shambhu Upadhyaya",
note = "Publisher Copyright: {\textcopyright} 2005 IEEE.; 3rd IEEE International Workshop on Information Assurance, IWIA 2005 ; Conference date: 23-03-2005 Through 25-03-2005",
year = "2005",
language = "English",
series = "Proceedings - 3rd IEEE International Workshop on Information Assurance, IWIA 2005",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "95--104",
booktitle = "Proceedings - 3rd IEEE International Workshop on Information Assurance, IWIA 2005",
address = "United States",
}