Design of Alert Merging Algorithm of Network-based Intrusion Detection System
Jianguo Jiang · Information and Electronic Engineering · 2005
The problem of huge numbers of similar or false alarms is ubiquitous in most network-based intrusion detection system (NIDS).Based on the CRIM module within MIRADOR project,an algorithm is designed to merge these similar alerts to reduce the existing huge numbers of alarms.Dynamic merging-time window and dynamic merging-number window are used to assure the alert keep alarming in time.The results of tentative experiment indicate that this method is effective when the NIDS produces large numbers of similar alerts.