  Intrusion detection systems (IDSs) generate valuable knowledge about network
security, but an abundance of false alarms and a lack of methods to capture the
interdependence among alerts hampers their utility for network defense. Here,
we explore a graph-based approach for fusing alerts generated by multiple IDSs
(e.g., Snort, OSSEC, and Bro). Our approach generates a weighted graph of alert
fields (not network topology) that makes explicit the connections between
multiple alerts, IDS systems, and other cyber artifacts. We use this
multi-modal graph to identify anomalous changes in the alert patterns of a
network. To detect the anomalies, we apply the role-dynamics approach, which
has successfully identified anomalies in social media, email, and IP
communication graphs. In the cyber domain, each node (alert field) in the fused
IDS alert graph is assigned a probability distribution across a small set of
roles based on that node's features. A cyber attack should trigger IDS alerts
and cause changes in the node features, but rather than track every feature for
every alert-field node individually, roles provide a succinct, integrated
summary of those feature changes. We measure changes in each node's
probabilistic role assignment over time, and identify anomalies as deviations
from expected roles. We test our approach using simulations including three
weeks of normal background traffic, as well as cyber attacks that occur near
the end of the simulations. This paper presents a novel approach to multi-modal
data fusion and a novel application of role dynamics within the cyber-security
domain. Our results show a drastic decrease in the false-positive rate when
considering our anomaly indicator instead of the IDS alerts themselves, thereby
reducing alarm fatigue and providing a promising avenue for threat intelligence
in network defense.
