An alert correlation algorithm based on the sequence pattern mining

Yanli Lv; Shuang Xiang; Jingxin Geng; Yuanlong Li; Chunhe Xia

doi:10.1109/IAEAC.2015.7428739

An alert correlation algorithm based on the sequence pattern mining

Yanli Lv
, Shuang Xiang
, Jingxin Geng
, Yuanlong Li
, Chunhe Xia

计算机学院

Beihang University
YingTu Wealth (Beijing) Investment Advisory Co. Ltd

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

5 引用（Scopus）

摘要

Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.

源语言	英语
主期刊名	Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015
编辑	Bing Xu
出版商	Institute of Electrical and Electronics Engineers Inc.
页	1146-1151
页数	6
ISBN（电子版）	9781479919796
DOI	https://doi.org/10.1109/IAEAC.2015.7428739
出版状态	已出版 - 7 3月 2016
活动	IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015 - Chongqing, 中国期限: 19 12月 2015 → 20 12月 2015

出版系列

姓名	Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

会议

会议	IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015
国家/地区	中国
市	Chongqing
时期	19/12/15 → 20/12/15

访问文件

10.1109/IAEAC.2015.7428739

其它文件与链接

链接到 Scopus 的出版物

引用此

Lv, Y., Xiang, S., Geng, J., Li, Y., & Xia, C. (2016). An alert correlation algorithm based on the sequence pattern mining. 在 B. Xu (编辑), Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015 (页码 1146-1151). 文章 7428739 (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/IAEAC.2015.7428739

Lv, Yanli ; Xiang, Shuang ; Geng, Jingxin 等. / An alert correlation algorithm based on the sequence pattern mining. Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015. 编辑 / Bing Xu. Institute of Electrical and Electronics Engineers Inc., 2016. 页码 1146-1151 (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015).

@inproceedings{e69a570d5f8a4c53b0937596fde5e485,

title = "An alert correlation algorithm based on the sequence pattern mining",

abstract = "Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.",

keywords = "Sequence diagram, alert correlation, correlation rule, mining, sequence pattern",

author = "Yanli Lv and Shuang Xiang and Jingxin Geng and Yuanlong Li and Chunhe Xia",

note = "Publisher Copyright: {\textcopyright} 2015 IEEE.; IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015 ; Conference date: 19-12-2015 Through 20-12-2015",

year = "2016",

month = mar,

day = "7",

doi = "10.1109/IAEAC.2015.7428739",

language = "英语",

series = "Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1146--1151",

editor = "Bing Xu",

booktitle = "Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015",

address = "美国",

}

Lv, Y, Xiang, S, Geng, J, Li, Y & Xia, C 2016, An alert correlation algorithm based on the sequence pattern mining. 在 B Xu (编辑), Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015., 7428739, Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015, Institute of Electrical and Electronics Engineers Inc., 页码 1146-1151, IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015, Chongqing, 中国, 19/12/15. https://doi.org/10.1109/IAEAC.2015.7428739

An alert correlation algorithm based on the sequence pattern mining. / Lv, Yanli; Xiang, Shuang; Geng, Jingxin 等.
Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015. 编辑 / Bing Xu. Institute of Electrical and Electronics Engineers Inc., 2016. 页码 1146-1151 7428739 (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015).

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

TY - GEN

T1 - An alert correlation algorithm based on the sequence pattern mining

AU - Lv, Yanli

AU - Xiang, Shuang

AU - Geng, Jingxin

AU - Li, Yuanlong

AU - Xia, Chunhe

PY - 2016/3/7

Y1 - 2016/3/7

N2 - Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.

AB - Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm orf attack behavior is put forward.

KW - Sequence diagram

KW - alert correlation

KW - correlation rule

KW - mining

KW - sequence pattern

UR - https://www.scopus.com/pages/publications/84966341175

U2 - 10.1109/IAEAC.2015.7428739

DO - 10.1109/IAEAC.2015.7428739

M3 - 会议稿件

AN - SCOPUS:84966341175

T3 - Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

SP - 1146

EP - 1151

BT - Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

A2 - Xu, Bing

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015

Y2 - 19 December 2015 through 20 December 2015

ER -

Lv Y, Xiang S, Geng J, Li Y, Xia C. An alert correlation algorithm based on the sequence pattern mining. 在 Xu B, 编辑, Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015. Institute of Electrical and Electronics Engineers Inc. 2016. 页码 1146-1151. 7428739. (Proceedings of 2015 IEEE Advanced Information Technology, Electronic and Automation Control Conference, IAEAC 2015). doi: 10.1109/IAEAC.2015.7428739

An alert correlation algorithm based on the sequence pattern mining

摘要

出版系列

会议

访问文件

其它文件与链接

学术指纹

引用此