Design and Implementation of an Alert Correlation Model for Intrusion Detection System
Wang Wei-ping · Computer and Modernization · 2008
Many problems exist in current intrusion detection systems,such as,high false positive ratio and false negative ratio,too many unmanageable and primitive alerts,etc.Alert correlation could be very helpful in solving these problems.This paper presents an alert correlation model,this model combines several alert correlation methods together,it divides alert correlation process into three layers: clustering,merging,and causality correlation,and can correlate alerts produced by multiple heterogeneous intrusion detection systems.