Correlating Alerts for DDoS Attack Prediction

• Grant number: 25/01622-2
• Support Opportunities: Scholarships in Brazil - Scientific Initiation
• Start date: April 01, 2025
• End date: March 31, 2026
• Field of knowledge: Physical Sciences and Mathematics - Computer Science
• Agreement: MCTI/MC
• Principal Investigator: Michele Nogueira Lima
• Grantee: Lucas Albano Olive Cruz
• Host Institution: Instituto de Ciências Exatas (ICEx). Universidade Federal de Minas Gerais (UFMG). Belo Horizonte , SP, Brazil
• Associated research grant: 18/23098-0 - MENTORED: from modeling to experimentation - predicting and detecting DDoS and zero-day attacks, AP.TEM

Abstract

Alert correlation is an essential advance to improve the prediction and detection of cyberattacks. With the development of several intrusion detection systems, the alerts generated often present distinct formats, different acquisition times, and a high volume of data, which makes correlation a challenge. However, integrating these sources can enrich the information base, enabling a more accurate and efficient analysis through prediction and detection mechanisms. Thus, this scientific initiation project proposes to investigate methods to correlate heterogeneous alerts, focusing on overcoming the technical challenges and on the practical application of this approach for DDoS attack prediction within the context of the MENTORED project.