Research and Design of Correlation Analysis Engine for Security Incident
Ding Zhi · Jisuanji gongcheng · 2006
Intrusion detection system is one of the dynamic defensive techniques,but current intrusion detection systems(IDSs) usually generate a large amount of false alerts and none of them can capture the logical steps or strategies behind the attacks.As a result,it is difficult for human users to understand the intrusions behind the alerts and take appropriate actions.This paper presents a correlation analysis approach based on the sequences and heuristic arithmetic to address these issues after analyzing large numbers of attack techniques and designs a correlation analysis engine for security incident and conducts one experiment to demonstrate the potential of the system,in reducing false alerts and uncovering attack strategies.