Towards Alert Verification Using Ontology-Based Context Classification in Event Correlation Process
Ting Gu · Journal of Beijing Jiaotong University · 2008
Intrusion Detection System (IDS) nowadays are known for producing a huge amount of alerts that are either not related to true alerts or not represented successful attacks due to lack of information to verify and to correlate IDS events. Alert verification, in the process of event correlation, is a method that we use to determine whether an alert from IDS is a false positive and to identify the success of an attack through context information of protected environment in two aspects. That is victim host context information and network context information. This paper presents alert analysis architecture in the event correlation process and then focuses on alert verification method using ontology-based context classification approach to achieve the goal of high efficiency of verification. An implementation shows in the end for the sake of validating the feasibility of the approach.