Intrusion alert correlation method based on uncertain knowledge discovery
Zhao Jian · Journal of Computer Applications · 2009
To solve the problems of large quantity,trivialness and dispersion of intrusion alerts in intrusion detection systems,an intrusion alert correlation method based on uncertain knowledge discovery was proposed.In the knowledge discovery part,a new discovery algorithm of uncertain sequence patterns,named CWINEPI,was used to discover the sequence patterns of intrusion alerts and translated them into intrusion alerts condensed rules.The attack patterns were obtained with correlating sequence patterns,and converted them into intrusion scenarios building rules.In the intrusion alerts correlation part,the alert correlation engine was used to correlate alerts produced by multi-intrusion detection systems.The experimental results on DARPA 2000 validate the good performance of the knowledge discovery part and show that the proposed method is efficient and feasible.