Improved Model of Intrusion Detection Alerts Correlation Based on Plan Recognition
JI Mei-xia · Journal of Qingdao University · 2007
On the basis of the analysis of current intrusion detection alert correlation algorithms,a new model of alerts correlation based on plan recognition was presented.Chosen 647 from MIT Lincoln data were used to simulate the model.The results show that specified raw alerts reduce to 112,which proves that the model can remove the irrelevant and redundant alerts,and improve the alerts' accuracy and quality.