Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

Intrusion DetectionDetection and correlation of intrusionsResearch Staff : Frédéric Cuppens, Nora Cuppens-Boulahia, Fabien Autrel, Yacine Bouzida, AurélienCroissantPh.D. Students: Wael KanounKeywords : Intrusion detection, alert correlation, attack response and correlation, CRIMApplications : Security Information Management (SIM)Partners & Funding : partially funded by the European programme CELTIC in the RED project(Reaction after Detection). partially funded by Alcatel-Lucent, ANRT through a CIFRE grant.IntroductionIntrusion detection is achieved through the useof network probes and host-based probeswhich detect suspicious or malicious actions.Those probes generate messages upon thedetection of such actions. Such messages arecalled intrusion detection alerts and must beprocessed by the system administrator tomonitor attempts to violate the security policy.However, this task becomes almost impossibledue to the high number of alerts generated perday (up to several thousands), most of thembeing false positives, i.e alerts not related toreal attacks. Intrusions can be very complexand detecting them involves the correlation ofseveral alerts.• alert correlation: alerts related to the sameintrusion are linked and ponderated topresent a comprehensible scenario to thesystem administrator• attack anticipation: this module generatesvirtual alerts to anticipate the evolution ofincomplete scenarios of attacks• response to scenarios: this module findsthe most effective responses to block ascenario or cancel the effects of an attackscenarioIn this context we have designed the CRIMmodule (Correlation and Reaction to MaliciousIntrusion) to help the system administratormanage the intrusion detection alerts.This research work is partially funded by theEuropean CELTIC project RED (Reaction AfterDetection). It is also part of a thesis supportedby ANRT through a CIFRE grant andundertaken within a collaboration betweenTELECOM Bretagne and ALCATEL-LUCENT.RealizationThe CRIM module [1] is composed of severalmodules which accomplish the following tasks(see figure 1):• alert management: alerts generated byseveral probes are centralized in adatabase for further processing• alert aggregation and fusion: similar alertsare grouped and then merged to lower thenumber of alerts to processFigure 1: The CRIM architectureThe aggregation/fusion module uses similarityfunctions between alert attributes and asimilarity threshold to aggregate similar alerts.Weights are defined over alert attributes tocomply with the fact that some attributes havedifferent meanings. Compared to other rulebasedaggregation systems, this module canprocess previously unseen alerts.The correlation and response modules rely ona semi-explicit approach based on thedescription of elementary attacks instead ofcomplete scenarios of attacks [2]. Elementaryattacks are described through the expressionof their pre-condition and post-condition. Firstorder logic is used to describe those conditionsand we have already identified a set ofpredicates allowing us to describe several40 Extract of Pracom’s Annual Report 2008