City Research Online

Intrusion alert prioritisation and attack detection using post-correlation analysis

Shittu, R., Healing, A., Ghanea-Hercock, R. , Bloomfield, R. E. & Rajarajan, M. (2015). Intrusion alert prioritisation and attack detection using post-correlation analysis. Computers & Security, 50, pp. 1-15. doi: 10.1016/j.cose.2014.12.003


Event Correlation used to be a widely used technique for interpreting alert logs and discovering network attacks. However, due to the scale and complexity of today's networks and attacks, alert logs produced by these modern networks are much larger in volume and difficult to analyse. In this research we show that adding post-correlation methods can be used alongside correlation to significantly improve the analysis of alert logs.

We proposed a new framework titled A Comprehensive System for Analysing Intrusion Alerts (ACSAnIA). The post-correlation methods include a new prioritisation metric based on anomaly detection and a novel approach to clustering events using correlation knowledge. One of the key benefits of the framework is that it significantly reduces false-positive alerts and it adds contextual information to true-positive alerts.

We evaluated the post-correlation methods of ACSAnIA using data from a 2012 cyber range experiment carried out by industrial partners of the British Telecom Security Practice Team. In one scenario, our results show that false-positives were successfully reduced by 97% and in another scenario, 16%. It also showed that clustering correlated alerts aided in attack detection.

The proposed framework is also being developed and integrated into a pre-existing Visual Analytic tool developed by the British Telecom SATURN Research Team for the analysis of cyber security data.

Publication Type: Article
Additional Information: © 2015, Elsevier. Licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International
Publisher Keywords: Alert correlation; Prioritisation; Clustering; Intrusion alert analysis; Anomaly detection
Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Departments: School of Science & Technology > Engineering
SWORD Depositor:
[thumbnail of Riyanat_C&S.pdf]
Text - Accepted Version
Available under License : See the attached licence file.

Download (749kB) | Preview
[thumbnail of Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Licence]
Text (Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Licence) - Other
Download (201kB) | Preview


Add to AnyAdd to TwitterAdd to FacebookAdd to LinkedinAdd to PinterestAdd to Email


Downloads per month over past year

View more statistics

Actions (login required)

Admin Login Admin Login