M2D2: A formal data model for IDS alert correlation

  • Benjamin Morin
  • , Ludovic Mé
  • , Hervé Debar
  • , Mireille Ducassé

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: Information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.

Original languageEnglish
Title of host publicationRecent Advances in Intrusion Detection - 5th International Symposium, RAID 2002, Proceedings
EditorsAndreas Wespi, Giovanni Vigna, Luca Deri
PublisherSpringer Verlag
Pages115-137
Number of pages23
ISBN (Print)3540000208, 9783540360841
DOIs
Publication statusPublished - 1 Jan 2002
Externally publishedYes
Event5th International Symposium on Recent Advances in Intrusion Detection, RAID 2002 - Zurich, Switzerland
Duration: 16 Oct 200218 Oct 2002

Publication series

NameLecture Notes in Computer Science
Volume2516 2516 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference5th International Symposium on Recent Advances in Intrusion Detection, RAID 2002
Country/TerritorySwitzerland
CityZurich
Period16/10/0218/10/02

Fingerprint

Dive into the research topics of 'M2D2: A formal data model for IDS alert correlation'. Together they form a unique fingerprint.

Cite this