Method and system for alert classification in a computer network

1. A method for classifying intrusion alerts in a computer network, the method comprising:

a) monitoring traffic data in a computer network;

b) detecting an occurrence of an intrusion from the monitored traffic data;

c) providing an intrusion alert and data in relation to the intrusion alert in response to the detection of the occurrence of the intrusion;

d) generating a statistical analysis of the data in relation to the intrusion alert, the data in relation to the intrusion alert as provided in response to the detection of the occurrence of the intrusion; and

e) classifying the intrusion alert as provided in the response to the detection of the occurrence of the intrusion, based on said statistical analysis of the data in relation to the intrusion alert, the classifying the intrusion alert providing an attack classification that identifies a context of the detected intrusion with respect to a vulnerability exploited and a target,

wherein generating said statistical analysis of the data in relation to the intrusion alert comprises generating information about a statistical distribution of n-grams using an n-gram analysis in at least a part of the data in relation to the intrusion alert, when n=1, the n-gram analysis being a 1-gram analysis, storing average byte frequency and standard deviation values, and when n>1 a fact is stored that a certain n-gram of the n-grams occurred without storing the average byte frequency and standard deviation values,

wherein generating the statistical analysis of the data in relation to the intrusion alert comprises applying a bloom filter on the statistical distribution of n-grams or storing the statistical distribution of n-grams in bitmap data structures, and

wherein classifying the intrusion alert based on said statistical analysis comprises:

e1) comparing at least a part of the statistical analysis, the statistical analysis comprising the statistical distribution of the n-grams, with at least a part of a model of intrusion alerts with predefined alert classes, using a machine learning technique; and

e2) assigning one of the predefined alert classes to the intrusion alert based on the comparison, thereby providing the attack classification that identifies the context of the detected intrusion with respect to the vulnerability exploited and the target.

2. The method according to claim 1 , wherein detecting the occurrence of the intrusion from the monitored traffic data comprises:

b1) detecting an anomaly on a basis of said monitoring and a model describing normal traffic data in the computer network.

3. The method according to claim 1 , wherein the data in relation to the intrusion alert comprises at least one payload of the traffic data that caused the intrusion alert.

4. The method according to claim 1 , wherein the n-grams are sequences of bytes.

5. The method according to claim 1 , wherein detecting the occurrence of the intrusion from the monitored traffic data comprises generating information about byte frequency in at least the part of the data in relation to the intrusion alert.

6. The method according to claim 1 , further comprising: before

a) monitoring traffic data in the computer network,

aa) generating the model of intrusion alerts with predefined alert classes.

7. The method according to claim 6 , wherein generating the model of intrusion alerts with predefined alert classes comprises:

aa1) providing a training set of data in relation to intrusion alerts;

aa2) generating a statistical analysis of said training set of data;

aa3) predefining at least two alert classes;

aa4) assigning predefined alert classes to one or more parts of said statistical analysis, based on information provided by one or more of a signature-based intrusion detection system, and a human operator; and

aa5) constructing the model of intrusion alerts comprising one or more parts of said statistical analysis and respective assigned predefined alert classes.

8. The method according to claim 1 , wherein the machine learning technique comprises one or more of a neural network, a support vector machine, and decision trees.

9. The method according to claim 1 , wherein the intrusion alert is classified in one of a

“false” class or a “true” class.

10. A system for classifying intrusion alerts in a computer network, the system comprising:

an intrusion detection system configured and operative for monitoring traffic data in the computer network, for detecting an occurrence of an intrusion from the monitored traffic data and for providing in response to the detection of the occurrence of the intrusion, an intrusion alert and data in relation to the intrusion alert the data in relation to the intrusion alert as provided by the intrusion detection system in response to the detection of the occurrence of the intrusion,

an alert information extractor configured and operative for generating a statistical analysis of the data in relation to the intrusion alert; and

an alert classification engine configured and operative for classifying the intrusion alert as provided by the intrusion detection system in response to the detection of the occurrence of the intrusion based on said statistical analysis of the data in relation to the intrusion alert as generated by the alert information extractor, the classifying the intrusion alert providing an attack classification that identifies a context of the detected intrusion with respect to a vulnerability exploited and a target,

wherein the alert information extractor is further configured to generate information about a statistical distribution of n-grams using an n-gram analysis in at least a part of the data in relation to the intrusion alert, when n=1, the n-gram analysis being a 1-gram analysis, storing average byte frequency and standard deviation values, and when n>1 a fact is stored that a certain n-gram of the n-grams occurred without storing the average byte frequency and standard deviation values,

wherein generating the statistical analysis of the data in relation to the intrusion alert comprises applying a bloom filter on the statistical distribution of n-grams or storing the statistical distribution of n-grams in bitmap data structures, and

wherein the alert classification engine is further configured to:

compare at least a part of the statistical analysis, the statistical analysis comprising the statistical distribution of the n-grams, with at least a part of a model of intrusion alerts with predefined alert comprising the statistical distribution of the n-grams, with at least the part of a model of intrusion alerts with predefined alert classes, using a machine learning technique; and

assign one of the predefined alert classes to the intrusion alert based on the comparison, thereby providing the attack classification that identifies the context of the detected intrusion with respect to the vulnerability exploited and the target.

11. The system according to claim 10 , wherein the intrusion detection system further comprises:

a traffic data monitor engine configured and operative for monitoring traffic data in the computer network;

an anomaly detector configured and operative for detecting an anomaly on a basis of said traffic data monitoring engine and a model describing normal traffic data in the computer network; and

an alert generator transmitter configured and operative for providing an intrusion alert in response to the detection of anomaly, and for providing data in relation to the intrusion alert.