# A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response
## 4 Conclusions  
This paper explored a novel approach to solving the problem of the high volume of alerts raised by intrusion detection systems. The main contribution is a hierarchical event correlation model that ingests raw events from the source and outputs correlated graph data structures to the detection part of the IDS. We showed that by correlating the raw events rather than alerts, the system reduced the complexity of security operations since it could be integrated into an IDS as a core correlation component; this contrasts with other approaches seen in prior art which rely on third-party systems to correlate alerts that have already been raised. We see an implementation of this model being integrated into a distributed IDS, where the data collection, correlation, and detection components are spread into different nodes. We showed that no intrusion information was lost during the correlation process. The input to the detection component was a significantly reduced set of aggregated events. Based on this observation, the IDS should detect threats just as it would based on the elementary events. This approach enables the IDS itself to raise fewer alerts, which enables a fast and real-time response to threats. The proposed model proves that by combining two complementary correlation techniques, the overall system is more efficient and effective. Our model employs similarity and graph-based correlation techniques in a hierarchy. The similarity-based correlation is performed at the first level of the hierarchy to achieve aggregation, data reduction, and clustering. Graph-based correlation is performed at the second level to interconnect related clusters and communication patterns and provide event visualization for ease of analysis. By combining these two approaches, the system benefits from their complementary strengths to achieve an integrated capability. Additionally, this research contributed to the security event correlation process. The process was used in the development of the proposed model to show its applicability. It is a process that is tailored to the correlation of raw events rather than alerts. In the future, we intend to develop \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Approach** & **Dataset** & **RC** & **RS** \\ \hline [PERSON] et al. [11] & The correlation is based on prerequisite and consequence with real-time data collection based on software agents. & CERCNET2 TESTBED & 0.77 & 0.81 \\ \hline [PERSON] et al. [41] & They propose a correlation system that uses alert semantics (based on the description field) and attack stages. & DARPA LLDOS 1.0 & 0.92 & - \\ \hline [PERSON] et al. [42] & They use Bayesian network-based alert correlation to discover attack strategies & DARPA LLDOS2.0.2 & 0.91 & 0.72 \\ \hline [PERSON] et al. [9] & They develop a correlation framework for cyberattack reconstruction utilizing natural language processing (NLP) and semantic similarity techniques & UNSW-NB15 & 0.54 & - \\ \hline Our model & The correlation of raw events is performed using a hierarchy of (1) temporal and attribute similarity and (2) graph-based correlation for uncovering suspicious network communication patterns & CICIDS-2017 & 0.87 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Comparison with related works. an integrated correlation-based intrusion detection component as a proof of concept to consume the correlated data, analyze, and detect threats. This work is in progress and already at an advanced level. Conceptualization, H.M. and K.O. ; methodology, H.M., K.O. and M.C.G. ; software, H.M. and K.O. ; validation, H.M., K.O., and M.C.G. ; formal analysis, H.M., K.O. and M.C.G. ; investigation, H.M., K.O. and M.C.G. ; resources, K.O. ; writing--original draft preparation, H.M., K.O. and M.C.G. ; writing--review and editing, K.O. and M.C.G. ; supervision, K.O. and M.C.G. ; project administration, H.M. All authors have read and agreed to the published version of the manuscript.