Model of network intrusion alerts real-time fusion
Yi Zhang · Computer Engineering and Applications Journal · 2012
To resolve the problem which distributed intrusion detection and network attack warning system has to confront, multi-sensor data fusion techniques are studied. Based on the analysis of various complex relationships of IDS alerts, this paper presents an alerts information real-time fusion model. An alerts information real-time fusion system based on it is realized, which can real-time fuse alarms from various heterogeneous IDS sensors, generate attack sequence view about intrusion, evaluate threaten and predict potential attacks. Furthermore, the function of reasoning false negative is introduced, which aims at reduce adverse effects of missed alerts and builds more integrated attack scenarios. Experimental results show that the real-time fusion system on this model works effectively, it has high accuracy and high alarm reduction rate.