A layered distributed alert correlation algorithm
Liang Tang · Journal of Changsha Telecommunications and Technology Vocational College · 2007
In large-scale high-speed network environment,an alert correlation algorithm used in Large-scale Distributed Intrusion Detection Systems correlates simple alerts produced by low-level components into complex alerts.Our algorithm uses three steps,which are congregation,coalition and correlation,to implement alert correlation.The algorithm can reduce the redundancy alerts,improve the detection efficiency and reduce the false positive rates.