Korelacija sigurnosnih uzbuna pomoću čestih podgrafova

master's thesis

• Title (english): Correlation of security alerts by frequent subgraph mining
• Author: Ivana Križić
• Mentor: Ante Đerek (mentor)
• Committee member: Ante Đerek (predsjednik povjerenstva)
• Committee member: Vlado Sruk (član povjerenstva)
• Committee member: Marko Čupić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2021-07-02, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Sustavi za otkrivanje napada (engl. Intrusion Detection Systems - IDS) nadziru mrežni promet te u slučaju otkrivanja potencijalno zlonamjernih aktivnosti generiraju sigurnosne uzbune. Problem upravljanja velikom količinom sigurnosnih uzbuna rješava se postupcima za korelaciju. Unutar ovog rada predložen je algoritam za korelaciju sigurnosnih uzbuna koji se sastoji od povezivanja sigurnosnih uzbuna u strukturne obrasce te provođenja frekvencijske analize nad istima s ciljem pronalaska onih obrazaca ponašanja koji se često pojavljuju unutar nadzirane mreže. Pritom su za frekvencijsku analizu korišteni alati za rudarenje čestih podgrafova - Gaston i MuGraM. Cilj tako razvijenog algoritma jest učinkovito prepoznavanje relevantnih sigurnosnih uzbuna te otkrivanje logičkih veza među njima što omogućuje sigurnosnom administratoru lakše razumijevanje istih.

Abstract (english)

Intrusion Detection Systems (IDS) monitor network traffic and generate alerts in case of detecting potentially malicious activities. The problem of managing large amount of alerts is solved by using an alert correlation. Within this paper, an alert correlation algorithm is proposed, which consists of linking security alerts into structured patterns and conducting frequency analysis over them in order to find those patterns of behavior that often occur within the monitored network. Frequent subgraph mining tools - Gaston and MuGraM - were used for frequency analysis. The goal of the algorithm developed in this way is to effectively identify relevant security alerts and detect logical connections between them, which enables the security administrator to more easily understand them.

• Keywords: mrežna sigurnost; sigurnosne uzbune; korelacija sigurnosnih uzbuna; mrežni napadi; Gaston; MuGraM
• Keywords (english): network security; alerts; alert correlation; network intrusion; Gaston; MuGraM
• Language: croatian
• URN:NBN: urn:nbn:hr:168:915258
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-15 10:36:45