An alert correlation algorithm based on the sequence pattern mining

Yanli Lv; Shuang Xiang; Jingxin Geng; Yuanlong Li; Chunhe Xia

doi:10.1109/IAEAC.2015.7428739

An alert correlation algorithm based on the sequence pattern mining

Yanli Lv
, Shuang Xiang
, Jingxin Geng
, Yuanlong Li
, Chunhe Xia

School of Computer Science and Engineering

Beihang University
YingTu Wealth (Beijing) Investment Advisory Co. Ltd

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

5 Scopus citations

Abstract

Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.

Original language	English
Title of host publication	Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015
Editors	Bing Xu
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1146-1151
Number of pages	6
ISBN (Electronic)	9781479919796
DOIs	https://doi.org/10.1109/IAEAC.2015.7428739
State	Published - 7 Mar 2016
Event	IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015 - Chongqing, China Duration: 19 Dec 2015 → 20 Dec 2015

Publication series

Name	Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

Conference

Conference	IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015
Country/Territory	China
City	Chongqing
Period	19/12/15 → 20/12/15

Keywords

Sequence diagram
alert correlation
correlation rule
mining
sequence pattern

Access to Document

10.1109/IAEAC.2015.7428739

Cite this

Lv, Y., Xiang, S., Geng, J., Li, Y., & Xia, C. (2016). An alert correlation algorithm based on the sequence pattern mining. In B. Xu (Ed.), Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015 (pp. 1146-1151). Article 7428739 (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/IAEAC.2015.7428739

Lv, Yanli ; Xiang, Shuang ; Geng, Jingxin et al. / An alert correlation algorithm based on the sequence pattern mining. Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015. editor / Bing Xu. Institute of Electrical and Electronics Engineers Inc., 2016. pp. 1146-1151 (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015).

@inproceedings{e69a570d5f8a4c53b0937596fde5e485,

title = "An alert correlation algorithm based on the sequence pattern mining",

abstract = "Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.",

keywords = "Sequence diagram, alert correlation, correlation rule, mining, sequence pattern",

author = "Yanli Lv and Shuang Xiang and Jingxin Geng and Yuanlong Li and Chunhe Xia",

note = "Publisher Copyright: {\textcopyright} 2015 IEEE.; IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015 ; Conference date: 19-12-2015 Through 20-12-2015",

year = "2016",

month = mar,

day = "7",

doi = "10.1109/IAEAC.2015.7428739",

language = "英语",

series = "Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1146--1151",

editor = "Bing Xu",

booktitle = "Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015",

address = "美国",

}

Lv, Y, Xiang, S, Geng, J, Li, Y & Xia, C 2016, An alert correlation algorithm based on the sequence pattern mining. in B Xu (ed.), Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015., 7428739, Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015, Institute of Electrical and Electronics Engineers Inc., pp. 1146-1151, IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015, Chongqing, China, 19/12/15. https://doi.org/10.1109/IAEAC.2015.7428739

An alert correlation algorithm based on the sequence pattern mining. / Lv, Yanli; Xiang, Shuang; Geng, Jingxin et al.
Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015. ed. / Bing Xu. Institute of Electrical and Electronics Engineers Inc., 2016. p. 1146-1151 7428739 (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - An alert correlation algorithm based on the sequence pattern mining

AU - Lv, Yanli

AU - Xiang, Shuang

AU - Geng, Jingxin

AU - Li, Yuanlong

AU - Xia, Chunhe

PY - 2016/3/7

Y1 - 2016/3/7

N2 - Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.

AB - Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.

KW - Sequence diagram

KW - alert correlation

KW - correlation rule

KW - mining

KW - sequence pattern

UR - https://www.scopus.com/pages/publications/84966341175

U2 - 10.1109/IAEAC.2015.7428739

DO - 10.1109/IAEAC.2015.7428739

M3 - 会议稿件

AN - SCOPUS:84966341175

T3 - Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

SP - 1146

EP - 1151

BT - Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

A2 - Xu, Bing

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

Y2 - 19 December 2015 through 20 December 2015

ER -

Lv Y, Xiang S, Geng J, Li Y, Xia C. An alert correlation algorithm based on the sequence pattern mining. In Xu B, editor, Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015. Institute of Electrical and Electronics Engineers Inc. 2016. p. 1146-1151. 7428739. (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015). doi: 10.1109/IAEAC.2015.7428739

An alert correlation algorithm based on the sequence pattern mining

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this