Alert aggregation method research based on dynamic time threshold
Lei Xu · 2010
Focus on adjacent time intervals changing problem of alert sequences triggered by a persistent attack in NIDS,this article proposes to describe time fluctuation character of alerts with a time variation coefficient and an alert aggregation method based on dynamic time threshold by which alert data are divided into temporal constraint feature and similarity constraint features.Experiment results show that redundancy alerts triggered by persistent attack can be decreased effectively.