Correlation and Collaboration in Anomaly Detection

This abstract describes research into improving the capabilities of intrusion detection systems (IDSs) based on probabilistic anomaly detection (AD). One technique involves correlating evidence obtained from two or more detection engines to generate well-founded alarms. A second technique combines evidence from engines running on different sensors to achieve the same goal. In both cases, the aim is to reduce the false-positive (FP) problem that is characteristic of detection schemes that use AD. We illustrate use of the techniques to augment the capabilities of an existing AD IDS (CounterStorm-1) to allow it to create high-quality alarms in the presence of attempted malicious data exfiltration.