RTEAS: A Real-Time Algorithm for Extracting Attack Scenarios from Intrusion Alert Stream

Intrusion Detection Systems (IDSs) are one of the mostly used security tools in computer networks.They seem to be a promising technology, yet they pose some serious drawbacks: When utilized in large and high traffic networks, IDSs generate high volume of low level alerts which is hardly manageable. In addition, IDSs usually generate redundant or even irrelevant (false) alerts. One technique proposed to circumvent such drawbacks is alert correlation, which extracts useful and high-level alerts, and helps in making timely decisions when a security breach occurs. In this paper, we propose a real-time algorithm for mining attack scenarios from the stream of alerts. The algorithm has a relatively good performance, both in speed and memory consumption. We applied our algorithm to DARPA 2000 intrusion detection scenario specific dataset. The experiment shows that it can extract attack strategies efficiently.