The Study of Alert Aggregation
Zhen Xu · Computers & Security · 2009
The imperfections the intrusion Detection System constraining the development of Intrusion Detection ,and Intrusion Detection has also become a focus of study. Alert aggregation, it very important to the Intrusion Detection System, can effectively reduce the member of alerts, and it can increase network warning ability. First, we categorize all alerts into four classes according to the attack event type, then make sure the relationship of the alerts and aggregate them, and find out the correlation between them finally.