LATTICED: An Algebra for Intrusion Correlation

入侵检测（ID）是一门不完美的科学。使用最先进的技术，可以相当容易地检测到具有明确签名的简单攻击，但是尝试诊断更复杂的攻击通常会导致大量误报和未检测到的攻击。如果身份识别系统能够协同工作，这种情况将得到改善，这样一个系统的弱点将被另一个系统的长处所弥补。然而，最近在结合ID结果方面的大部分工作都集中在系统的协议和体系结构上。即使是像确证这样简单的过程——试图就单一的攻击诊断达成一致——也不能仅仅依靠协议和架构来保证。如果没有一个基本的理论体系，将多个身份识别系统的结果结合起来的努力仍然会失败。LATTICE计划是定义一种一致和全面的方法来组合多个ID系统的结果。该研究将采用图论方法来表示单个ID系统的结论。可以定义运算符，以可以理解和分析的严格方式组合ID诊断的图形表示。这些方法产生的结果可以理解为多个系统的结论，作为一个整体。这种方法的结果是所有相关ID系统的能力和优势的严格统一。

Intrusion detection (ID) is an imperfect science. With state-of-the-art techniques, simple attacks with unambiguous signatures can be detected fairly easily, but trying to diagnose more complex attacks often results in a flurry of false positives and undetected attacks.This situation would be improved if ID systems could work together, so that the weaknesses of one would be covered by the strengths of another. However, most of the recent work in combining ID results has focused on the protocol and architecture of the systems. Even a process as simple as corroboration--attempting to agree on a single attack diagnosis--is not assured with only protocol and architecture. Without an underlying body of theory, efforts to combine the results of multiple ID systemswill still fail.The LATTICE plan is to define a consistent and comprehensive way to combine the results of multiple ID systems. The research will employ a graph theory approach to representing the conclusions of individual ID systems. Operators can be defined to combine the graph representations of ID diagnoses in rigorous ways that can be comprehended and analyzed. The results generated by these methods can be understood as the conclusions of the multiple systems, taken as a whole. The outcome of this approach is a rigorous unifying of the abilities and strengths of all the involved ID systems.