Network Security Event Correlation for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems face challenges in accurately and timely detecting intrusions due to high false alarm rates and the difficulty in distinguishing between normal system usage and true intrusions, especially in heterogeneous and homogeneous security event sources.
Innovation Solution
A computer-based system that captures security events from various sources, divides them into event flows, and generates meta-events through statistical correlation methods to evaluate perimeter defense devices and detect tampering, providing a centralized and scalable architecture for real-time monitoring and alert generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If knowledge-based intrusion detection approaches are used, then false alarm rates are reduced and contextual analysis is improved, but difficulty in gathering and maintaining up-to-date attack information increases
Solution Approach 1:
The system segments intrusion detection into multiple specialized components: event capture modules that collect raw security events, event normalization modules that standardize different event formats, pattern matching engines that compare against known attack signatures, and behavior analysis modules that detect anomalies. This segmentation allows each component to specialize in one aspect, improving detection reliability while distributing the complexity burden.
Solution Approach 2:
The system performs preliminary actions by pre-collecting and storing attack signature databases, vulnerability information, and baseline behavior patterns before intrusion detection is needed. These preprocessed knowledge bases are continuously updated and organized for rapid querying, reducing the complexity of real-time information gathering while maintaining up-to-date attack knowledge.
2Adaptability or versatility
If behavior-based intrusion detection approaches are used, then detection of new and unforeseen vulnerabilities is improved, but false alarm rates increase
Solution Approach 1:
The system merges knowledge-based detection (pattern matching against known signatures) and behavior-based detection (anomaly detection using statistical models) into a unified intrusion detection framework. Events are evaluated through both approaches simultaneously, allowing the system to benefit from the low false alarm rate of knowledge-based methods while maintaining the adaptability to detect new vulnerabilities through behavior-based methods.
Solution Approach 2:
The system implements feedback mechanisms where detected intrusions and false alarms are analyzed to refine behavior models and update knowledge bases. When behavior-based detection generates alerts, these are validated against known attack patterns, and the results feed back into adjusting behavior thresholds and updating signature databases, thereby reducing false alarms while maintaining detection of new vulnerabilities.
Data Source
AI summary
Events are received from a plurality of security devices (which may be similar or different devices, e.g., intrusion detection systems configured to monitor network traffic) and divided into a plurality of event flows. Comparing the event flows (e.g., using statistical correlation methods) then generates one or more meta-events. The received events may be divided into different event flows on the basis of the security device which generated the events. The meta-events may be generated by evaluating a perimeter defense device through comparison of the different event flows. In some cases, various ones of the security devices may be inside or outside a perimeter defined by the perimeter defense device.