Alert Verification and Aggregation Based on Multi-source Security Information
Zhang Zhi-bin · Jisuanji gongcheng · 2006
In order to deal with the large quantity of low quality intrusion detection alerts,the alert verification and aggregation technic based on multi-source security information is developed.The model of alert verification is based on logic predication.The spatial,temporal properties and attack type are analyzed to aggregate the alerts.The method put forward can get rid of non-relevant positive alerts and eliminate redundant alerts timely.