Correlation between NetFlow System and Network Views for Intrusion Detection
Cristina L. Abad, Yifan Li, Kiran Lakkaraju, Xiaoxin Yin, William J. Yurcik · 2004
We present several ways to correlate security events from two applications that visualize the same underlying data with two distinct views: system and network. Correlation of security events provide Security Engineers a better understanding of what is happening for enhanced security situational awareness. Visualization leverages human cognitive abilities and promotes quick mental connections between events that otherwise may be obscured in the volume of IDS alert messages.