# A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response
## 2 Proposed Approach
### Level 1--Similarity-Based Correlation
#### 2.3.2 Event Clustering  
Before the events can be clustered, association rules are defined to mine data from the \(AES\) that represent the fundamental analytics for network communications. Each aggregate \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Timestamp** & **Src\_IP** & **Dst\_IP** & **Src\_Port** & **Dst\_Port** & **Proto** & **Bytes** \\ \hline
12:31:57.740 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline
12:33:02.540 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline
12:35:00.750 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline
12:38:03.760 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Aggregated event, E. \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Timestamp** & **Src\_IP** & **Dst\_IP** & **Src\_Port** & **Dst\_Port** & **Protocol** & **Bytes** \\ \hline
12:31:57.740 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline
12:33:02.540 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline
12:35:00.750 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline
12:38:03.760 & 192.168.204.69 & 192.168.204.1 & 68 & 67 & UDP & 328 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Individual event log entries. event \(E\) in \(AES\) has \(n\) candidate correlations, where n is the number of features that make up the aggregate event. To mine the correlation candidates, a minimum of \(n\) association rules is created for each candidate cluster. The general form of a rule \(R\) is given below. \[R=[attr_{1},attr_{2},\ldots,attr_{k}],\;sup\geq k\leq n \tag{2}\]  
A support value sup dictates the minimum frequent itemsets to be considered for the correlation, while \(n\) is the number of all the features of the aggregated event. This allows the creation of candidate correlations at varying levels of correlations with different values of \(k\). In the implementation of this model, the network event log entry is defined by the 5-tuple below. \[Net_{L}=[S_{IP},S_{port},D_{IP},D_{port},Protocol] \tag{3}\]  
Based on the network event log, the mining association rules below are defined. \[SC:A_{i}=B_{i}\;\forall i\in[S_{IP},D_{IP},S_{port},D_{port},Protocol] \tag{4}\]  
\[VC_{1}:A_{i}\equiv B_{i}\;\forall i\in[S_{IP},D_{IP},S_{port},D_{port}] \tag{5}\]  
\[VC_{2}:A_{i}\equiv B_{i}\;\forall i\in[S_{IP},D_{IP},S_{port}] \tag{6}\]  
\[VC_{3}:A_{i}\equiv B_{i}\;\forall i\in[S_{IP},D_{IP},D_{port}] \tag{7}\]  
\[VC_{4}:A_{i}\equiv B_{i}\;\forall i\in[S_{IP},D_{IP}] \tag{8}\]  
Shared correlations, \(SC\), indicate that the same host is communicating on the same applications. Correlation with variance level 1, \(VC_{1}\), is achieved when the same source host talks to the same target host on the same application but using different protocols. Correlation with variance level 2, \(VC_{2}\), is when the same host and the same target are communicating on the same application using the same source ports, while the destination ports or protocol could be different. In \(VC_{3}\), the same source is accessing the same target host and destination port but could be using different source ports. When only the source and destination IP addresses are similar, this is mined by the \(VC_{4}\) rule. A careful inspection of these rules should reveal that they represent the foundational analytics for analyzing network events. Other types of analytics can be derived from various correlations or interconnections of the clusters created. For example, the \(SC\) represent normal traffic in general terms. However, if the number of these correlations and the volume of traffic keeps increasing in a time series analysis, there could be a DoS attack in flight. Similarly, an increase in \(VC_{2}\) correlations could signal a probe attack, as the source is sending so many packets to the destination from different source ports.