EP1700453A1

EP1700453A1 - Method for managing a set of alarms emitted by sensors for detecting intrusions of a information security system

Info

Publication number: EP1700453A1
Application number: EP04816392A
Authority: EP
Inventors: Benjamin Morin; Hervé Debar
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2003-12-17
Filing date: 2004-12-16
Publication date: 2006-09-13
Also published as: FR2864282A1; US7810157B2; US20070150579A1; WO2005060205A1

Abstract

The invention relates to a method for managing a set of alarms emitted by intrusion detecting sensors (11a, 11b, 11c) of an information security system (1) comprising an alarm managing system (13), wherein each alarm is identified by an alarm identifier and an alarm content consisting in assigning a description comprising a conjunction of a plurality of valued attributes allocated to a plurality of attribute ranges to each alarm emitted by said intrusion detecting sensors (11a, 11b, 11c), organising the valued attributes allocated to each attribute range into a taxonomic structure defining generalisation ratios between said valued attributes and the plurality of attribute ranges forming the structure of taxonomic structures, completing the description of each said alarm by a set of values induced by the taxonomic structures from the valued attribute of said alarms in order to form completed alarms and in storing said completed alarms in a logic files (21) in such a way that it is possible to reference thereon.

Description

Title of invention

Method for managing a set of alerts from intrusion detection probes of an information security system.

Background of the Invention The invention relates to a method for managing a set of alerts from intrusion detection probes. The security of information systems requires the deployment of “IDS” intrusion detection systems comprising intrusion detection probes that issue alerts to alert management systems. In fact, intrusion detection probes are active components of the intrusion detection system that analyze one or more data sources in search of events characteristic of an intrusive activity and issue alerts to management systems alert. An alert management system centralizes alerts from probes and optionally performs an analysis of all of these alerts. The intrusion detection probes generate a very large number of alerts which can include several thousands per day depending on the configurations and the environment. The excess of alerts can result from a combination of several phenomena. First, false alerts account for up to 90% of the total number of alerts. Then, the alerts are often too granular, that is to say that their semantic content is very poor.

Finally, alerts are often redundant and recurrent. Thus, the excess of alerts makes them difficult to understand and manipulate by a human security operator. Upstream processing of alerts at the management system level is therefore necessary to facilitate the analysis work of the security operator. Current alert management systems consist of storing alerts in a relational database management system (RDBMS). The security operator can thus interrogate this RDBMS management system by submitting a request relating to the properties of the alerts. The RDBMS management system provides in return to the operator, all the alerts whose description meets the request. The disadvantage of these systems is the fact that the alerts provided to the operator can be numerous and granular, which makes their analysis tedious.

Ob and and summary of the invention The invention aims to remedy these drawbacks, and to provide a simple method of managing a set of alerts from intrusion detection probes to allow flexible, easy consultation and quick of this set of alerts. These goals are achieved by a method of managing a set of alerts from intrusion detection probes of an information security system comprising an alert management system, each alert being defined by an identifier. alert and alert content, characterized in that it comprises the following steps: -associating with each of the alerts from the intrusion detection probes, a description comprising a conjunction of a plurality of value attributes belonging to a plurality of attribute domains; organize the value attributes belonging to each attribute domain into a taxonomic structure defining generalization relationships between said value attributes, the plurality of attribute domains thus forming a plurality of taxonomic structures; complete the description of each of said alerts with sets of values induced by the taxonomic structures from the value attributes of said alerts to form complete alerts; -store said full alerts in a logical file system to allow consultation. Thus, storing complete alerts in a logical file system allows a security operator to consult the alert management system in an efficient, fast and flexible manner in order to obtain an accurate view of all of the alerts from intrusion detection probes. The consultation of complete alerts can be carried out by a succession of interrogations and / or navigations in said complete alerts so that in response to a request, the alert management system provides relevant value attributes making it possible to distinguish a sub -set of complete alerts among a set of complete alerts satisfying the request in order to allow the refinement of said request. Preferably, the relevant value attributes are in priority the most general with regard to the plurality of taxonomic structures. Advantageously, in response to the request, the alert management system also provides alert identifiers satisfying the request and the description of which cannot be refined with respect to said request. The alert identifier is a pair formed by an identifier of the intrusion detection probe which produces the alert and an alert serial number assigned by said probe. The content of each alert includes a text message provided by the corresponding intrusion detection probe. Each value attribute has an attribute identifier and an attribute value. According to one aspect of the invention, each attribute identifier is associated with an attribute domain among the following domains: domain of the attack, domain of the identity of the attacker, domain of the identity of the victim and date range of the attack. Advantageously, the description of a given alert is supplemented by recovering from the generalization relationships of the plurality of taxonomic structures and recursively, a set comprising the more general value attributes and which has not already been present in the description of '' another alert previously completed. According to a particular aspect of the invention, the attributes valued in the taxonomic structure are organized according to a directed acydic graph. The invention also relates to a computer program designed to implement the above method, when it is executed by the alert management system.

Brief description of the drawings Other particularities and advantages of the invention will emerge on reading the description given below, by way of indication but not limitation, with reference to the appended drawings, in which: FIG. 1 is a view very schematic of an information security system comprising an alert management system according to the invention; FIG. 2 is a flowchart illustrating the steps of the method for managing a set of alerts, according to the invention; FIG. 3A illustrates an example of documentation associated with signatures of attacks; and FIG. 3B very schematically shows a taxonomic structure associated with the example of FIG. 3A. Detailed description of embodiments FIG. 1 illustrates an example of an intrusion detection system 1 connected through a router 3 to an external network 5 and to an internal network 7a and 7b with distributed architecture. The intrusion detection system 1 comprises several intrusion detection probes 11a, 11b, lie, and an alert management system 13. Thus, a first intrusion detection probe 11a monitors the alerts coming from the outside, a second probe 11b monitors part of the internal network 7a comprising work stations 15 and a third probe 11b monitors another part of the internal network 7b comprising servers 17 delivering information to the external network 5. The management system alerts 13 includes a host 19 dedicated to processing alerts, a logical file system 21, and an output unit 23. The logical file system can be of the "LISFS" type proposed by Padioleau and Ridoux, in a conference (Usenix Annual Technical Conference 2003) entitled "A Logic File System". In the LISFS logical file system, files are objects with associated descriptions, expressed in propositional logic. The description of a file is a combination of properties. The properties of the files are the directories of the file system, so that the path of a file is its description. A path is therefore a logical formula. A file system location contains all the files whose description satisfies the formula corresponding to the location path. As in a classic file system, specific commands allow you to navigate and manipulate the files and their descriptions. Thus, the probes 11a, 11b, 11e deployed in the intrusion detection system 1 send (arrows 26) their alerts 25 to the system for managing alerts 13. The latter, in accordance with the invention, manages this set of alerts and stores it in the logical file system 21 to allow consultation thereof through the output unit 23 in a flexible way. In fact, the host 19 of the alert management system 13 includes processing means for carrying out this alert management. Thus, a computer program designed to implement the present invention can be executed by the alert management system. FIG. 2 is a flowchart illustrating the steps of the method for managing a set O of alerts originating from intrusion detection probes according to the invention. Each alert o in this set O of alerts is defined by an alert identifier and alert content. Indeed, an alert oe O can be defined by a unique alert identifier id (ό) given by a pair (s, n) where s is the serial identifier of the intrusion detection probe which produces the alert and n is an alert serial number assigned by this probe to alert o. The content m ₀ of the alert o includes a text message provided by the intrusion detection probe which produced the alert and which is intended for the security operator. Step El consists in associating with each of the alerts from the intrusion detection probes 11a, 11b, lie, a description d {o) comprising a conjunction of a plurality of value attributes {d _oi j belonging to a plurality or a set of attribute domains {A}. Thus, a description d (o) of an alert is a conjunction of p value attributes, i.e. d (o) = d _ol Λ --- Λd _op . A value attribute d _0j is a pair (a, v) comprising an attribute identifier a and an attribute value v. Each attribute identifier a is associated with an attribute domain A from the following domains: attack domain, attacker identity domain, victim identity domain and date date domain the attack. In general, an attribute domain A is formed of a discrete set provided with a partial order relation _A defining the domain of the attribute value d _oi . Step E2 consists in organizing the value attributes d _oi belonging to each attribute domain A into a taxonomic structure defining generalization (or specialization) relationships between these value attributes. There is a taxonomy by attribute domain. Thus, the plurality of attribute domains forms a plurality of taxonomic structures. The taxonomic structure of the value attributes is generically a directed acydic graph. The taxonomic relationships are modeled by axioms. Thus, a value attribute d more specific than another value attribute d 'is modeled by an axiom d \ = d that is to say that the attribute value d' is a logical consequence of the attribute value d. In other words, an alert that has the specific value attribute d automatically has the less specific value attribute of. Step E3 consists of completing the description of each of the alerts from the intrusion detection probes 11a, 11b, lie, by sets of values induced by the taxonomic structures, from the value attributes of these initial alerts, to form full alerts. Indeed, the value attributes of the alerts produced by the intrusion detection probes are the most specific of the taxonomies. Thus, on receipt of a given alert, the alert management system 13 can, for example, complete the description of this alert by recovering from generalization relationships the plurality of taxonomic structures and recursively, a set comprising more general value attributes that have not already been present in the description of another previously completed alert. In other words, the description of a given alert is completed by a process which consists in going back in a given taxonomy from a given value attribute. If a value attribute already exists in the description of another previously processed alert, then the escalation process stops, otherwise it is added and the process is repeated from this added value attribute. Below is an example of an algorithm

"Complete Description" describing a process to complete the description of an alert. CompléterDescription if it does not exist to _oi for each d ₀ ' _j e D do Complete Description (d ₀ ') does mkdird ^ 'l-ld ^ done This algorithm first tests the existence of a given value attribute d _0j . If this attribute d _0j does not exist, we recover the set

D = ψ _g ' _j : d _oi | = d ₀ ' _j ) of the value attributes which are more abstract with regard

taxonomies. Then for each element of ₀ ^' _j belonging to D, the ComplementDescription algorithm is called recursively. At the end, the value attribute is added to the alert management system by the "mkdir" command which is part of the LISFS logical file system commands. Finally, step E4 of FIG. 2, consists of storing the alerts, which were completed in the previous step, in the logical file system 21 to allow consultation thereof. Below is an example of a "StoreAlert" algorithm describing a process for storing a new alert in a logical file system like LISFS. Store Alert For each d _oi to Complete Description ^ d _oi ) cp m ₀ d _o l - ld _on / α This algorithm completes iteratively for each description element d _oi , a given alert o by calling the algorithm

"Complete Description" described above. When all the description elements of the given alert are completed, then the complete alert and its content are stored by a storage command "cp", which takes as parameter the content of the alert m _of the description of the alert d _0tl l — ld _0tΛ and the identifier of the alert α. The storage of full alerts in the logical file system 21 allows their consultation by a succession of interrogations and / or browsing in all of the full alerts. Thus, in response to a request from a security operator, the alert management system 13 provides relevant value attributes making it possible to distinguish a subset of full alerts from a set of full alerts satisfying the request in order to allow the refinement of this query. A request from the security operator is a logical formula, which combines conjugations Λ, disjunctions v, and negations

-i of value attributes. In general, the description d {o) of an alert o satisfies a request, if the request / is a logical consequence of the description d (o). The set of alerts satisfying the request /, called the extension of /, is thus given by eχt (/) = {oe O: d (o) | = /}. The set A of relevant value attributes is the set of value attributes belonging to value attribute fields A, such as for any relevant value attribute p of A, the set of full alerts satisfying the conjunction of the current request / with the relevant value attribute p is contained strictly in the set of full alerts satisfying the current query /. Thus, this set A of relevant value attributes which make it possible to distinguish alerts between them, can be defined as follows: A - {pe A: c ext (f A p) c ext ()}. The set A can be considered as a set of navigation links, by defining each relevant value attribute p as a navigation link. The security operator can thus refine his current request / by choosing a navigation link eg A provided by the alert management system 13. The current request / by the security operator is thus transformed into the new request / Λ p. Advantageously, to further reduce the number of responses, the alert management system 13 provides, as a priority, the most general relevant value attributes with regard to the plurality of taxonomic structures. The set A _msκ of the most general relevant value attributes is then given by the set maχ _{| =} (-4) which can be defined as follows: ma _{| =} (^) = {pe A: there exists not p'e A, p '≠ ρ, p \ = p'}. Thus, this set max _{| =} (.4), is the set of any relevant value attribute p of A which does not have a more general value attribute. In addition, in response to the current request /, the alert management system provides a set O of alert identifiers whose description satisfies the current request / and which cannot be refined, that is to say described more precisely, in relation to this request /. Thus, the set O of alert identifiers includes any alert identifier whose description satisfies the current request / and such that there is no relevant value attribute p such that the conjunction of / and p is satisfied by the description of this same alert. Thus, this set O can be defined as follows:

O = {id (ό): oe O, d (o) | = /, and there is no pe A with d (o) | = / Λ p}. Note that the logical file system 21 such as LISFS offers commands allowing to navigate (“cd” command), interrogate (“Is” command), and store (“cp” and mkdir ”commands) objects. For example, in LISFS, a request to obtain alerts for which the victim is a web proxy and whose attacker is not internal is expressed as follows: Is / "victim web proxy" /! "internal attacker". Generally speaking, an alert from an intrusion detection probe is a quadruple of value attributes. The four attributes considered are: attack, attacker, victim, and date. The domain of the attribute value “attack” consists of the identifiers of signature of attacks contained in the alerts generated by the intrusion detection probes lia, 11b, lie. The domain of the attack value attribute also includes the vulnerabilities possibly exploited by an attack. The vulnerabilities are more abstract, that is to say more general, than attack identifiers. The other values used to qualify the attacks come from the keywords used to qualify the attacks in a documentation of the intrusion detection probes lia, 11b, lie. As an example, you can use the Snortl ™ probe and the "msg" field in the signature documentation. Indeed, FIG. 3A illustrates an example of documentation associated with the signatures of attacks. Column 31 of Table 33 has whole numbers designating the signatures of attacks. Column 35 of Table 33 includes the documentation associated with these attack signatures. Thus, in each line of table 33, documentation is associated with each attack signature. Each description includes keywords relating for example to the type of attack, the network protocol used, and the success or failure of the attack. FIG. 3B shows a taxonomic structure 37 defining generalization relationships 39 between the value attributes contained in table 33. This taxonomic structure 37 is organized according to expert knowledge, using the keywords from the documentation of the signatures in table 33. On note that, the attack signatures 31 constitute the most specific value attributes. The domain of the value attribute “attackers” contains IP addresses. External IP addresses can be generalized by the name of the organization owning the range of IP addresses to which it belongs the address. The name of the organization corresponds to the "netname" field contained in the databases of the IANA ™ organization, which manages the allocation of IP addresses. Internal IP addresses and private IP addresses (non-routable) can be generalized into local network identifiers defined by an administrator of the intrusion detection system 1. Finally, the names of organizations can be generalized to the value "ext" and the identifiers local networks can be generalized to the “int” value. The value attribute domain "victim" has IP addresses. These victims' IP addresses can be generalized to the address of the corresponding local network. These IP addresses can also be generalized into machine names, obtained by name resolution mechanisms. Machine names can be generalized into host “functions” (for example web server), defined by the site administrator. Machine names can be generalized into local network identifiers defined by the network administrator (for example DMZ). The value attribute field "date" includes the timestamping of alerts in DD-MM-YYYY format hh: mm: ss. The dates are successively generalized in minutes, hour, day, and month in the year. These generalizations ultimately correspond to increasingly crude abstractions of the date of an attack.

Claims

claims

1. Method for managing a set of alerts from intrusion detection probes (11a, 11b, lie) of an information security system (1) comprising an alert management system (13) , each alert being defined by an alert identifier and an alert content, characterized in that it comprises the following steps: -associate with each of the alerts from the intrusion detection probes (lia, îlb, lie) , a description comprising a conjunction of a plurality of value attributes belonging to a plurality of attribute domains;

organize the value attributes belonging to each attribute domain into a taxonomic structure defining generalization relationships between said value attributes, the plurality of attribute domains thus forming a plurality of taxonomic structures;

complete the description of each of said alerts with sets of values induced by the taxonomic structures from the value attributes of said alerts to form complete alerts; -store said full alerts in a logical file system (21) to allow consultation.

2. Method according to claim 1, characterized in that the consultation of the complete alerts is carried out by a succession of interrogations and / or navigations in the said complete alerts so that in response to a request, the management system of alerts (13) provides relevant value attributes making it possible to distinguish a subset of full alerts from a set of full alerts satisfying the request in order to allow the refinement of said request.

3. Method according to claim 2, characterized in that the relevant value attributes are in priority the most general with regard to the plurality of taxonomic structures.

4. Method according to any one of claims 2 and 3, characterized in that in response to the request, the alert management system (13) also provides alert identifiers satisfying the request and the description of which cannot be refined with respect to said request.

5. Method according to claim 1, characterized in that the alert identifier is a pair formed by an identifier of the intrusion detection probe (11a, 11b, lie) which produces the alert and a alert serial number assigned by said probe.

β.A method according to claim 1, characterized in that the content of each alert includes a text message provided by the corresponding intrusion detection probe (11a, 11b, lie).

7. Method according to any one of claims 1 to 6, characterized in that each value attribute comprises an attribute identifier and an attribute value.

δ.A method according to claim 7, characterized in that each attribute identifier is associated with an attribute domain among the following domains: attack domain, attacker identity domain, domain of identity of victim and area of date of attack.

9. Method according to claim 1, characterized in that the description of a given alert is completed by recovering from the relationships of generalization of the plurality of taxonomic structures and recursively, a set comprising the more general value attributes and not having already been present in the description of another alert previously completed.

10. The method according to any one of claims 1 to 9, characterized in that the attributes valued in the taxonomic structure are organized according to a directed acydic graph.

11. Computer program characterized in that it is designed to implement the method according to any one of claims 1 to 10 when it is executed by the alert management system (13).