A privacy-preserving alert correlation model

Data holders need to share the alerts data that they detected for correlation and analysis purpose. In such cases, privacy issues turn out to be a major concern. This paper proposes a model to correlate and analyze intrusion alerts with privacy-preserving capability. The raw intrusion alerts are protected by improved k-anonymity method, which preserves the alert regulation inside disturbed data records. Combining this privacy preserving method with typical FP-tree frequent pattern mining approach and WINEPI sequence pattern mining algorithm, an alert correlation model is set up to well balance the alert correlation and the privacy protection. Experimental results show that this model reaches close similarity of correlation and analysis result comparing with original FP-tree and WINEPI algorithm, while sensitive attributes are well preserved.