A Quality Assurance Framework for Network Attack Correlation

Traditional intrusion detection techniques cannot handle the uncertainty and complexity of network attack correlation tasks. They lack the capability to assure the quality of knowledge fusion especially in large distributed systems, which is the key to efficient cyber defense. We propose a systematic and process-oriented approach to engineer network attack correlation, which, based on a probabilistic model, focuses on reconfigurability and quality assurance of distributed intrusion detection systems in a well-controlled paradigm. We elaborate the conceptual framework in this exploratory study along with some preliminary evaluation results introduced and conclude with future directions