DocumentationIn this page we present a little explanation of the Nariz systemNariz is a distributed alert correlation system, that performs alarm correlation in two phases, locally preprocessing and distributed postprocessing. The distibuted correlation of alerts is a new technique that is well suited to high speed networks since it can be implemented on machines using lower computing power than it would be possible with centralized correlation. Every time an IDS reports an alert the Nariz obtains that alert and does a local correlation with simple correlation rules. The correlation rules are based on the following variables from the IDS alert:
The initial value of limiar is zero. This variable determines the coincidence degree
between the alerts. Through this variable individual
correlators exchange messages to correlate intrusion alerts and a message is sent to a human
manager whenever the distributed system collects enough information regarding an intrusion
attempt. This way, the Nariz system can reduce the number of messages sent to the human
overseers, while eliminating some of the false positives.
In this first situation we show three organizations in differents countries that have an IDS analysing their own traffic. On each IDS a Nariz is placed to correlate the alerts. This way each Nariz correlates alerts of the local IDS and when the distributed correlation trigger is activated, the Nariz sends an alert through the network to other Nariz to correlate this alert. When a Nariz receives an alert that is not local, this alert can have a greater limiar than a local one, to indicate that this alert is more severe then the local one. So the correlation of alerts is done by distributing alerts through the network to each Nariz, and when an alert activates the PANIC trigger, an alert is sent to the Security Admin.
In this last picture, the mechanism of distributed correlation is shown in more details. The router/switch in this picture could be the Internet and the IDS sensors could be also simple IDS, like explained in the first situation. On this picture we can see that the Nariz gets the IDS sensors alerts and correlates to the alerts that is already stored in the Nariz alerts database.
|