M2D2: A Formal Data Model for IDS Alert Correlation View Full Text


Ontology type: schema:Chapter      Open Access: True


Chapter Info

DATE

2002

AUTHORS

Benjamin Morin , Ludovic Mé , Hervé Debar , Mireille Ducassé

ABSTRACT

At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2. More... »

PAGES

115-137

References to SciGraph publications

  • 2001-09-27. Aggregation and Correlation of Intrusion-Detection Alerts in RECENT ADVANCES IN INTRUSION DETECTION
  • 2000. LAMBDA: A Language to Model a Database for Detection of Attacks in RECENT ADVANCES IN INTRUSION DETECTION
  • Book

    TITLE

    Recent Advances in Intrusion Detection

    ISBN

    978-3-540-00020-4
    978-3-540-36084-1

    Author Affiliations

    Identifiers

    URI

    http://scigraph.springernature.com/pub.10.1007/3-540-36084-0_7

    DOI

    http://dx.doi.org/10.1007/3-540-36084-0_7

    DIMENSIONS

    https://app.dimensions.ai/details/publication/pub.1019349336


    Indexing Status Check whether this publication has been indexed by Scopus and Web Of Science using the SN Indexing Status Tool
    Incoming Citations Browse incoming citations for this publication using opencitations.net

    JSON-LD is the canonical representation for SciGraph data.

    TIP: You can open this SciGraph record using an external JSON-LD service: JSON-LD Playground Google SDTT

    [
      {
        "@context": "https://springernature.github.io/scigraph/jsonld/sgcontext.json", 
        "about": [
          {
            "id": "http://purl.org/au-research/vocabulary/anzsrc-for/2008/0806", 
            "inDefinedTermSet": "http://purl.org/au-research/vocabulary/anzsrc-for/2008/", 
            "name": "Information Systems", 
            "type": "DefinedTerm"
          }, 
          {
            "id": "http://purl.org/au-research/vocabulary/anzsrc-for/2008/08", 
            "inDefinedTermSet": "http://purl.org/au-research/vocabulary/anzsrc-for/2008/", 
            "name": "Information and Computing Sciences", 
            "type": "DefinedTerm"
          }
        ], 
        "author": [
          {
            "affiliation": {
              "alternateName": "Orange (France)", 
              "id": "https://www.grid.ac/institutes/grid.89485.38", 
              "name": [
                "France T\u00e9l\u00e9com R&D, Caen, France"
              ], 
              "type": "Organization"
            }, 
            "familyName": "Morin", 
            "givenName": "Benjamin", 
            "id": "sg:person.013114004075.10", 
            "sameAs": [
              "https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.013114004075.10"
            ], 
            "type": "Person"
          }, 
          {
            "affiliation": {
              "alternateName": "Sup\u00e9lec", 
              "id": "https://www.grid.ac/institutes/grid.424471.0", 
              "name": [
                "Sup\u00e9lec, Rennes, France"
              ], 
              "type": "Organization"
            }, 
            "familyName": "M\u00e9", 
            "givenName": "Ludovic", 
            "id": "sg:person.07761036762.44", 
            "sameAs": [
              "https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.07761036762.44"
            ], 
            "type": "Person"
          }, 
          {
            "affiliation": {
              "alternateName": "Orange (France)", 
              "id": "https://www.grid.ac/institutes/grid.89485.38", 
              "name": [
                "France T\u00e9l\u00e9com R&D, Caen, France"
              ], 
              "type": "Organization"
            }, 
            "familyName": "Debar", 
            "givenName": "Herv\u00e9", 
            "id": "sg:person.016303555143.12", 
            "sameAs": [
              "https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.016303555143.12"
            ], 
            "type": "Person"
          }, 
          {
            "affiliation": {
              "name": [
                "IRISA/INSA, Rennes, France"
              ], 
              "type": "Organization"
            }, 
            "familyName": "Ducass\u00e9", 
            "givenName": "Mireille", 
            "id": "sg:person.010214413243.65", 
            "sameAs": [
              "https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.010214413243.65"
            ], 
            "type": "Person"
          }
        ], 
        "citation": [
          {
            "id": "sg:pub.10.1007/3-540-39945-3_13", 
            "sameAs": [
              "https://app.dimensions.ai/details/publication/pub.1007204231", 
              "https://doi.org/10.1007/3-540-39945-3_13"
            ], 
            "type": "CreativeWork"
          }, 
          {
            "id": "sg:pub.10.1007/3-540-45474-8_6", 
            "sameAs": [
              "https://app.dimensions.ai/details/publication/pub.1028240787", 
              "https://doi.org/10.1007/3-540-45474-8_6"
            ], 
            "type": "CreativeWork"
          }, 
          {
            "id": "sg:pub.10.1007/3-540-45474-8_6", 
            "sameAs": [
              "https://app.dimensions.ai/details/publication/pub.1028240787", 
              "https://doi.org/10.1007/3-540-45474-8_6"
            ], 
            "type": "CreativeWork"
          }
        ], 
        "datePublished": "2002", 
        "datePublishedReg": "2002-01-01", 
        "description": "At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.", 
        "editor": [
          {
            "familyName": "Wespi", 
            "givenName": "Andreas", 
            "type": "Person"
          }, 
          {
            "familyName": "Vigna", 
            "givenName": "Giovanni", 
            "type": "Person"
          }, 
          {
            "familyName": "Deri", 
            "givenName": "Luca", 
            "type": "Person"
          }
        ], 
        "genre": "chapter", 
        "id": "sg:pub.10.1007/3-540-36084-0_7", 
        "inLanguage": [
          "en"
        ], 
        "isAccessibleForFree": true, 
        "isPartOf": {
          "isbn": [
            "978-3-540-00020-4", 
            "978-3-540-36084-1"
          ], 
          "name": "Recent Advances in Intrusion Detection", 
          "type": "Book"
        }, 
        "name": "M2D2: A Formal Data Model for IDS Alert Correlation", 
        "pagination": "115-137", 
        "productId": [
          {
            "name": "doi", 
            "type": "PropertyValue", 
            "value": [
              "10.1007/3-540-36084-0_7"
            ]
          }, 
          {
            "name": "readcube_id", 
            "type": "PropertyValue", 
            "value": [
              "5c3137c2fd81e097232f90af41d94e6c49e9da8cff95234704849e5df1e8c94d"
            ]
          }, 
          {
            "name": "dimensions_id", 
            "type": "PropertyValue", 
            "value": [
              "pub.1019349336"
            ]
          }
        ], 
        "publisher": {
          "location": "Berlin, Heidelberg", 
          "name": "Springer Berlin Heidelberg", 
          "type": "Organisation"
        }, 
        "sameAs": [
          "https://doi.org/10.1007/3-540-36084-0_7", 
          "https://app.dimensions.ai/details/publication/pub.1019349336"
        ], 
        "sdDataset": "chapters", 
        "sdDatePublished": "2019-04-15T14:24", 
        "sdLicense": "https://scigraph.springernature.com/explorer/license/", 
        "sdPublisher": {
          "name": "Springer Nature - SN SciGraph project", 
          "type": "Organization"
        }, 
        "sdSource": "s3://com-uberresearch-data-dimensions-target-20181106-alternative/cleanup/v134/2549eaecd7973599484d7c17b260dba0a4ecb94b/merge/v9/a6c9fde33151104705d4d7ff012ea9563521a3ce/jats-lookup/v90/0000000001_0000000264/records_8669_00000255.jsonl", 
        "type": "Chapter", 
        "url": "http://link.springer.com/10.1007/3-540-36084-0_7"
      }
    ]
     

    Download the RDF metadata as:  json-ld nt turtle xml License info

    HOW TO GET THIS DATA PROGRAMMATICALLY:

    JSON-LD is a popular format for linked data which is fully compatible with JSON.

    curl -H 'Accept: application/ld+json' 'https://scigraph.springernature.com/pub.10.1007/3-540-36084-0_7'

    N-Triples is a line-based linked data format ideal for batch operations.

    curl -H 'Accept: application/n-triples' 'https://scigraph.springernature.com/pub.10.1007/3-540-36084-0_7'

    Turtle is a human-readable linked data format.

    curl -H 'Accept: text/turtle' 'https://scigraph.springernature.com/pub.10.1007/3-540-36084-0_7'

    RDF/XML is a standard XML format for linked data.

    curl -H 'Accept: application/rdf+xml' 'https://scigraph.springernature.com/pub.10.1007/3-540-36084-0_7'


     

    This table displays all metadata directly associated to this object as RDF triples.

    109 TRIPLES      23 PREDICATES      29 URIs      20 LITERALS      8 BLANK NODES

    Subject Predicate Object
    1 sg:pub.10.1007/3-540-36084-0_7 schema:about anzsrc-for:08
    2 anzsrc-for:0806
    3 schema:author N2c6b3e1d3fe249f39c088c6beae05121
    4 schema:citation sg:pub.10.1007/3-540-39945-3_13
    5 sg:pub.10.1007/3-540-45474-8_6
    6 schema:datePublished 2002
    7 schema:datePublishedReg 2002-01-01
    8 schema:description At present, alert correlation techniques do not make full use of the information that is available. We propose a data model for IDS alert correlation called M2D2. It supplies four information types: information related to the characteristics of the monitored information system, information about the vulnerabilities, information about the security tools used for the monitoring, and information about the events observed. M2D2 is formally defined. As far as we know, no other formal model includes the vulnerability and alert parts of M2D2. Three examples of correlations are given. They are rigorously specified using the formal definition of M2D2. As opposed to already published correlation methods, these examples use more than the events generated by security tools; they make use of many concepts formalized in M2D2.
    9 schema:editor Nd32627e37337448fa7e9550c56883b39
    10 schema:genre chapter
    11 schema:inLanguage en
    12 schema:isAccessibleForFree true
    13 schema:isPartOf Nffa2fd480a6b4891a97336fdb644d192
    14 schema:name M2D2: A Formal Data Model for IDS Alert Correlation
    15 schema:pagination 115-137
    16 schema:productId N56fe2cbb422a41188f2a0284c897fbfc
    17 Nc474f2a162e94df297dbc40ff58b0be9
    18 Ne4ad6196024b4aa4b4ed95ff3953bac8
    19 schema:publisher N88bfcd9588bd471695b11d316fb4803a
    20 schema:sameAs https://app.dimensions.ai/details/publication/pub.1019349336
    21 https://doi.org/10.1007/3-540-36084-0_7
    22 schema:sdDatePublished 2019-04-15T14:24
    23 schema:sdLicense https://scigraph.springernature.com/explorer/license/
    24 schema:sdPublisher N710517416c994fffb4bb7bd0d3ea99af
    25 schema:url http://link.springer.com/10.1007/3-540-36084-0_7
    26 sgo:license sg:explorer/license/
    27 sgo:sdDataset chapters
    28 rdf:type schema:Chapter
    29 N13b081af4a364fc29e478d5cf1310873 rdf:first sg:person.010214413243.65
    30 rdf:rest rdf:nil
    31 N2b3aa2975cf44ec98173d6f1c46b2d6e schema:name IRISA/INSA, Rennes, France
    32 rdf:type schema:Organization
    33 N2c6b3e1d3fe249f39c088c6beae05121 rdf:first sg:person.013114004075.10
    34 rdf:rest Nbb43af2040d04606a970612a0d422b8f
    35 N2f4ce503904f48898c08cacef1396bb0 schema:familyName Vigna
    36 schema:givenName Giovanni
    37 rdf:type schema:Person
    38 N4a99dc6c10d343e1bc024906e1422ce8 rdf:first Nf650cc21bebf4260ab0f16602b2832b1
    39 rdf:rest rdf:nil
    40 N56fe2cbb422a41188f2a0284c897fbfc schema:name readcube_id
    41 schema:value 5c3137c2fd81e097232f90af41d94e6c49e9da8cff95234704849e5df1e8c94d
    42 rdf:type schema:PropertyValue
    43 N710517416c994fffb4bb7bd0d3ea99af schema:name Springer Nature - SN SciGraph project
    44 rdf:type schema:Organization
    45 N88bfcd9588bd471695b11d316fb4803a schema:location Berlin, Heidelberg
    46 schema:name Springer Berlin Heidelberg
    47 rdf:type schema:Organisation
    48 Nb303888f9c5e40ec85f40ad2c505bc77 rdf:first N2f4ce503904f48898c08cacef1396bb0
    49 rdf:rest N4a99dc6c10d343e1bc024906e1422ce8
    50 Nbb43af2040d04606a970612a0d422b8f rdf:first sg:person.07761036762.44
    51 rdf:rest Nc76ff748e26342b8afc5f3abbfea87ff
    52 Nc474f2a162e94df297dbc40ff58b0be9 schema:name dimensions_id
    53 schema:value pub.1019349336
    54 rdf:type schema:PropertyValue
    55 Nc76ff748e26342b8afc5f3abbfea87ff rdf:first sg:person.016303555143.12
    56 rdf:rest N13b081af4a364fc29e478d5cf1310873
    57 Nd32627e37337448fa7e9550c56883b39 rdf:first Nf272aec31358496d86be262c8988c478
    58 rdf:rest Nb303888f9c5e40ec85f40ad2c505bc77
    59 Ne4ad6196024b4aa4b4ed95ff3953bac8 schema:name doi
    60 schema:value 10.1007/3-540-36084-0_7
    61 rdf:type schema:PropertyValue
    62 Nf272aec31358496d86be262c8988c478 schema:familyName Wespi
    63 schema:givenName Andreas
    64 rdf:type schema:Person
    65 Nf650cc21bebf4260ab0f16602b2832b1 schema:familyName Deri
    66 schema:givenName Luca
    67 rdf:type schema:Person
    68 Nffa2fd480a6b4891a97336fdb644d192 schema:isbn 978-3-540-00020-4
    69 978-3-540-36084-1
    70 schema:name Recent Advances in Intrusion Detection
    71 rdf:type schema:Book
    72 anzsrc-for:08 schema:inDefinedTermSet anzsrc-for:
    73 schema:name Information and Computing Sciences
    74 rdf:type schema:DefinedTerm
    75 anzsrc-for:0806 schema:inDefinedTermSet anzsrc-for:
    76 schema:name Information Systems
    77 rdf:type schema:DefinedTerm
    78 sg:person.010214413243.65 schema:affiliation N2b3aa2975cf44ec98173d6f1c46b2d6e
    79 schema:familyName Ducassé
    80 schema:givenName Mireille
    81 schema:sameAs https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.010214413243.65
    82 rdf:type schema:Person
    83 sg:person.013114004075.10 schema:affiliation https://www.grid.ac/institutes/grid.89485.38
    84 schema:familyName Morin
    85 schema:givenName Benjamin
    86 schema:sameAs https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.013114004075.10
    87 rdf:type schema:Person
    88 sg:person.016303555143.12 schema:affiliation https://www.grid.ac/institutes/grid.89485.38
    89 schema:familyName Debar
    90 schema:givenName Hervé
    91 schema:sameAs https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.016303555143.12
    92 rdf:type schema:Person
    93 sg:person.07761036762.44 schema:affiliation https://www.grid.ac/institutes/grid.424471.0
    94 schema:familyName
    95 schema:givenName Ludovic
    96 schema:sameAs https://app.dimensions.ai/discover/publication?and_facet_researcher=ur.07761036762.44
    97 rdf:type schema:Person
    98 sg:pub.10.1007/3-540-39945-3_13 schema:sameAs https://app.dimensions.ai/details/publication/pub.1007204231
    99 https://doi.org/10.1007/3-540-39945-3_13
    100 rdf:type schema:CreativeWork
    101 sg:pub.10.1007/3-540-45474-8_6 schema:sameAs https://app.dimensions.ai/details/publication/pub.1028240787
    102 https://doi.org/10.1007/3-540-45474-8_6
    103 rdf:type schema:CreativeWork
    104 https://www.grid.ac/institutes/grid.424471.0 schema:alternateName Supélec
    105 schema:name Supélec, Rennes, France
    106 rdf:type schema:Organization
    107 https://www.grid.ac/institutes/grid.89485.38 schema:alternateName Orange (France)
    108 schema:name France Télécom R&D, Caen, France
    109 rdf:type schema:Organization
     




    Preview window. Press ESC to close (or click here)


    ...