LATTICED: An Algebra for Intrusion Correlation

入侵检测是一门不完善的科学。有了最先进的技术，具有明确特征的简单攻击可以相当容易地被检测出来，但试图诊断更复杂的攻击往往会导致一连串的误报和未被检测到的攻击。如果身份识别系统能够协同工作，这种情况就会得到改善，这样一个系统的弱点就会被另一个系统的优点所掩盖。然而，最近在合并ID结果方面的大部分工作都集中在系统的协议和体系结构上。即使是像验证这样简单的过程--试图就单一攻击诊断达成一致--也不能仅通过协议和架构来确保。如果没有一个基本的理论体系，整合多个身份识别系统的结果的努力仍将失败。格子计划是定义一种一致和全面的方式来结合多个身份识别系统的结果。这项研究将使用图论方法来表示个人身份识别系统的结论。可以定义运算符，以便以可理解和分析的严格方式组合ID诊断的图形表示。这些方法产生的结果可以理解为多个系统的结论，作为一个整体。这种方法的结果是严格统一了所有涉及的身份识别系统的能力和优势。

Intrusion detection (ID) is an imperfect science. With state-of-the-art techniques, simple attacks with unambiguous signatures can be detected fairly easily, but trying to diagnose more complex attacks often results in a flurry of false positives and undetected attacks.This situation would be improved if ID systems could work together, so that the weaknesses of one would be covered by the strengths of another. However, most of the recent work in combining ID results has focused on the protocol and architecture of the systems. Even a process as simple as corroboration--attempting to agree on a single attack diagnosis--is not assured with only protocol and architecture. Without an underlying body of theory, efforts to combine the results of multiple ID systemswill still fail.The LATTICE plan is to define a consistent and comprehensive way to combine the results of multiple ID systems. The research will employ a graph theory approach to representing the conclusions of individual ID systems. Operators can be defined to combine the graph representations of ID diagnoses in rigorous ways that can be comprehended and analyzed. The results generated by these methods can be understood as the conclusions of the multiple systems, taken as a whole. The outcome of this approach is a rigorous unifying of the abilities and strengths of all the involved ID systems.