Research on hierarchical alarm processing model in intrusion detection system
Meng Dai · Jisuanji yingyong yanjiu · 2009
In view of the alarm flooding problem,this paper studied a hierarchical alarm processing model to filter,reduce,fuse and correlate alarm data.In filtering,eliminated false alarms with repository.In reduction,designed a reduction algorithm to remove the duplicate alarms in real time.In fusion,proposed a clustering-based fusion algorithm to banish similar alarms in real time.In correlation,implemented the frequent episodes algorithm on training data to find the intrusion patterns and constructed repository which provided similarity to the clustering-based correlation algorithm.Through the above processing,eliminated the false and invalid alarms,which eased the networks system and administrator's burden.Meanwhile,found the intrusion patterns and reported the alarm prediction.Experimental results show the model is effective.