Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: To defend against multi-step intrusions in high-speed networks, efficient algorithms are needed to correlate isolated alerts into attack scenarios. Existing correlation methods usually employ an in-memory index for fast searches among received alerts. With finite memory, the index can only be built on a limited number of alerts inside a sliding window. Knowing this fact, an attacker can prevent two attack steps from both falling into the sliding window by either passively delaying the second step or actively injecting bogus alerts beten the two steps. In either case, the correlation effort is defeated. ,  first address the above issue with a novel queue graph (QG) approach. Instead of searching all the received alerts for those that prepare for a new alert,  only search for the latest alert of each type. The correlation beten the new alert and other alerts is implicitly represented using the temporal order beten alerts. Consequently, our approach can correlate alerts that are arbitrarily far away, and it has a linear (in the number of alert types) time complexity and quadratic memory requirement. Then,  extend the basic QG approach to a unified method to hypothesize missing alerts and to predict future alerts. Finally,  propose a compact representation for the result of alert correlation. Empirical results show that our method can fulfill correlation tasks faster than an IDS can report alerts. Hence, the method is a promising solution for administrators to monitor and predict the progress of intrusions and thus to take appropriate countermeasures in a timely manner.
['Lingyu Wang', 'Anyi Liu', 'Sushil Jajodia']
I am writing a research paper on a idea Using attack graphs for correlating, hypothesizing, and predicting intrusion alerts
[{"from": "human", "value": "I am writing a research paper on a idea Using attack graphs for correlating, hypothesizing, and predicting intrusion alerts"}, {"from": "gpt", "value": "Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: To defend against multi-step intrusions in high-speed networks, efficient algorithms are needed to correlate isolated alerts into attack scenarios. Existing correlation methods usually employ an in-memory index for fast searches among received alerts. With finite memory, the index can only be built on a limited number of alerts inside a sliding window. Knowing this fact, an attacker can prevent two attack steps from both falling into the sliding window by either passively delaying the second step or actively injecting bogus alerts beten the two steps. In either case, the correlation effort is defeated. ,  first address the above issue with a novel queue graph (QG) approach. Instead of searching all the received alerts for those that prepare for a new alert,  only search for the latest alert of each type. The correlation beten the new alert and other alerts is implicitly represented using the temporal order beten alerts. Consequently, our approach can correlate alerts that are arbitrarily far away, and it has a linear (in the number of alert types) time complexity and quadratic memory requirement. Then,  extend the basic QG approach to a unified method to hypothesize missing alerts and to predict future alerts. Finally,  propose a compact representation for the result of alert correlation. Empirical results show that our method can fulfill correlation tasks faster than an IDS can report alerts. Hence, the method is a promising solution for administrators to monitor and predict the progress of intrusions and thus to take appropriate countermeasures in a timely manner."}]