Intrusion Alert Classification via N-gram Statistical Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly-based intrusion detection systems generate numerous alerts that require manual inspection by security teams, leading to a significant workload, as they cannot automatically classify and respond to intrusion alerts without prior identification of the intrusion.
Innovation Solution
A method and system that classify intrusion alerts through statistical analysis of traffic data, using n-gram analysis and machine learning techniques to automatically assign alerts to predefined classes, enabling automated countermeasure policies and efficient alert management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly-based intrusion detection systems are used to detect zero-day attacks, then detection capability for unknown attacks is improved, but the number of alerts requiring manual inspection increases significantly
Solution Approach 1:
The patent segments alerts into multiple classification levels (e.g., attack type, severity, source/destination). By dividing the alert management task into hierarchical categories, the system enables automated responses for common attack types while maintaining human review for complex cases, thus resolving the contradiction between comprehensive detection and manageable alert volume
Solution Approach 2:
The system performs self-classification of alerts using statistical analysis and pattern recognition algorithms. The intrusion detection system automatically analyzes alert characteristics, compares them against learned patterns, and assigns classifications without human intervention, enabling the system to manage its own output and reduce manual workload
2Reliability
If manual inspection of each alert is performed to choose countermeasure policies, then appropriate security responses can be applied, but security team workload increases
Solution Approach 1:
The system performs preliminary classification of alerts automatically before they reach security personnel. By pre-analyzing alert data, extracting features, and assigning initial classifications, the system prepares alerts for targeted human review, allowing security teams to focus only on unclassified or high-priority alerts
Solution Approach 2:
The patent introduces an intermediary classification layer between alert generation and human response. This intermediate system analyzes alerts, applies statistical models, and provides suggested classifications or response actions, serving as a mediator that reduces the direct burden on security personnel while maintaining response quality
3Loss of information
If signature-based intrusion detection systems are used, then attack classification is provided, but the system cannot detect zero-day attacks
Solution Approach 1:
The patent merges the strengths of both signature-based and anomaly-based detection systems. It combines pattern-matching capabilities for known attack classification with statistical anomaly detection for unknown attacks, creating a hybrid system that provides both classification information and zero-day detection capability simultaneously
Data Source
AI summary
A method and a system for classification of intrusion alerts in computer network is provided. The method comprises the steps of monitoring traffic data in a computer network, detecting an intrusion, providing an intrusion alert and data in relation to the intrusion alert, generating a statistical analysis of the data in relation to the intrusion alert and classifying the intrusion alert based on said statistical analysis. The intrusion alerts and the data in relation to an intrusion alert may be generated by anomaly-based intrusion detection system. The generating a statistical analysis may comprise generating information about a statistical distribution of n-grams in the data. The classification may comprise comparing the statistical analysis with a model analysis of intrusion alerts with predefined alert classes. This model may be generated by providing a training set of data in relation to alerts, generating a model statistical analysis of said data, predefining at least two alert classes, and assigning predefined alert classes to the statistical analysis, based on information provided by a signature-based intrusion detection system, or by a human operator.