Research on extenics-based alert analysis techniques for network security
Min Xiao · Jisuanji yingyong yanjiu · 2008
Network users need a new integrated solution for network security management,or in other words,unified network security management.This paper discussed alert analysis,which was one of its key functionalities.The proposal had IDS alerts as the center,and realized alert analysis by means of two-step correlation including alert evaluation and alert correlation.In order to effectively overcame the problems and limitations existing in analysis technologies of current IDSs and follow in the trend of unification for network security management,introduced an extenics-based method as technical support for implementing all the proposed functions for network security alert analysis,since extenics has a great advantage in dealing with contradiction problems.