@inproceedings{e38f931890224cfaaf5cdc4c79f6d552,
title = "M2D2: A formal data model for IDS alert correlation",
abstract = "At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: Information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.",
author = "Benjamin Morin and Ludovic M{\'e} and Herv{\'e} Debar and Mireille Ducass{\'e}",
note = "Publisher Copyright: {\textcopyright} Springer-Verlag Berlin Heidelberg 2002.; 5th International Symposium on Recent Advances in Intrusion Detection, RAID 2002 ; Conference date: 16-10-2002 Through 18-10-2002",
year = "2002",
month = jan,
day = "1",
doi = "10.1007/3-540-36084-0\_7",
language = "English",
isbn = "3540000208",
series = "Lecture Notes in Computer Science",
publisher = "Springer Verlag",
pages = "115--137",
editor = "Andreas Wespi and Giovanni Vigna and Luca Deri",
booktitle = "Recent Advances in Intrusion Detection - 5th International Symposium, RAID 2002, Proceedings",
}