Fusing A Heterogeneous Alert Stream Into Scenarios O. Dain and R.K. Cummingham From: Applications of data Mining in Computer Security (Eds. D. Barabara and S. Jajodia)

Objective To combine alerts (generated by multiple IDSs in an organization) into scenarios Each scenario is a sequence of actions performed by a single actor or an organization To group alerts that share a common cause False alarm probabilities are assigned to scenarios rather than individual alerts For each new alarm generated, compare it to existing scenarios and compute probability that it belongs to that

Data Mining Techniques Used to assign probabilities for an alert to belong to a scenario---to provide better predictive power Since attackers often use the same tools or attack types, many features were included to indicate if any previous alerts in the scenario are the exact same type as the current alert and if the most recent alert in the scenario is the same as the new alert Attackers focus on a single host---so destination address is one of the features