A Model of IDS Alert Analysis Based on Correlation
Yongqiang He · Microelectronics & Computer · 2008
Aiming at resolving the problem that currently IDS has overload alerts and high rate of false negative, this paper uses the method of filter testing and Correlation analysis to process the original alerts . Experiments show that the model is effective in reducing the number of alerts and false negative rate. At the same time, the system can classify and sum up alerts according to dangerous levels and show the graphic reports to users, so as to achieve the purpose of warning.