Research on Threat-based Dynamic Alerts Management
Xie Li · 2008
One of the primary issues of IDSes is excessive false positives.This adds heavy burden to the system manager,which may lead the essential attacks to be ignored,and lead the automated intrusion response,e.g.cooperating with firewalls,can't carry out well.To resolve these issue,this paper presents a TDAM(Threat-based Dynamic Alerts Management)model.It analyzes alerts by apperceiving the system environment to specify the alerts' threat.A conclusion can be drawn from the experiment that the TDAM model can well apply in alerts evaluation and management.