Decision-level fusion model of multi-source intrusion detection alerts
Dapeng Man · DOAJ (DOAJ: Directory of Open Access Journals) · 2011
In order to lessen the dependence on training samples significantly and eliminate rigorous constraint conditions,an alert fusion model that supports online incremental training was presented.Firstly,primary alerts vector was mapped to voting pattern,so as to reduce statistical space.Then,the conditional probability distributions of various voting patterns in normal or attack traffic were inferred via training.Afterwards,according to the variation of statistical characteristics,the composition of the traffic being detected was inferred instantly.Finally,fusion decision was made via threshold constraint method and Bayesian inference.Besides extended applicative scope,the model proposed can track and adapt to the traffic being detected well,and improve detection performance significantly only via small scale training.