An intelligent network-warning model with strong survivability

Abstract

Over the past decades more and more network security devices, such as IDS, Firewall and scanner, are distributed in the network. So superfluous alerts are generated, and do not have unified format. How to organize and utilize those alerts to enhance network security becomes a hot topic of research. Network-warning system, which can correlate alerts and predict future attacks, appears as one promising solution for the problem. In this paper, an intelligent strong-survivability network-warning model is introduced, which consists of a lot of intelligent agents. And a prototype is implemented based on the model. We propose a self-adaptive data-processing algorithm for classifying and reducing alerts automatically, and design a strong-survivability structure. The intelligence of self-adaptive algorithm depends on machine learning. In the prototype we adopt three methods (C5.0, Neural Net and CART) to construct the self-adaptive algorithm, and choose the best method fitting the algorithm, which is CART. The prototype can not only reduce and classify the original alert data from different network security devices, but also correlate alerts and generate intrusion scenario graphs. The equality of all agents makes the model strong-survivable. Furthermore, the model can predict potential attacks based on scenario graphs and track the attack sources1. © Springer-Verlag Berlin Heidelberg 2007.