Intrusion Detection Alert Correlation Algorithm Based on Goal Graph
Yan Yi-wei · Computer Technology and Development · 2009
In respect to the problems of the lowly ability of intrusion response and the high false-rate of intrusion detection,proposes a novel alert correlation algorithm based on goal graph,which maintains the precondition and the effect condition in the action-level,traces the system states and the attack states by the information of alert,observing the changes of the state,and infers the attack intention and method.The experiments show that this method can recognize the attack intention from the correlated alerts correctly and effectively,and is more efficient to reduce the false-rate.