Research and Implementation of Alerts Correlation Approach Based on Data Mining
MI Zhaotuan · Science Technology and Engineering · 2006
On the basis of analyzing drawbacks of current intrusion detection systems(IDS), an alert correlation systems based on data mining is proposed. The experiment results show that the method can correlate and fuse the alerts effiensienly, can reduce the number of alerts to 72.4% at least, and can reduce false negative to 21.2% at least.