Multilevel Fusion Model of INFOSEC Alert
LV Luo-wen · Computer Engineering and Applications Journal · 2006
Alert fusion is an effective method to reduce redundant alerts and recognize complicated attack scenario.Currently,most proposed fusion methods are concentrate on special aspects.The multilevel fusion model can implement alert normalization,verification,aggregation and correlation,the low-level alerts are reduced layer upon layer,and then the high-level attack scenario is abstracted from alerts.The experimental results show that the model is effective and efficient.