Frequent item set mining-based alert correlation for extracting multi-stage attack scenarios

Intrusion detection systems are one of the most useful security tools in computer networks. Although these Systems, are successful security technologies but they are faced with some problems. Correlation of alerts is one of the methods to deal with these problems. Correlation engine extract useful and high-level information and is effective in decision on time when network intrusions are happened. In this paper, we propose a new framework for real-time alert correlation which consists of two phases: Alert Preprocessing Phase and Scenario Constructing Phase. In our structure, we aggregate alerts into graph structures and then we extract unknown attack scenarios with mining frequent structure patterns. This method is based on the observation that most alerts have frequent and sequential characteristic, since we can use frequent item set mining methods for extracting attack scenarios. Our algorithm is efficient in memory and time consumption. For evaluation of our algorithm we used DARPA2000 dataset. The results show that our proposed algorithm can extract the attack scenarios exactly.