A New Method of Correlation Analysis for Intrusion Detection Alert
Zhanjun Hao · Computers & Security · 2010
Alert clustering and correlation are very important development direction in the field of intrusion detection, alert clustering correlates those alert information that have identical or similar feature, and alert correlation alarms depending on the causal dependencies between the attacking. In this paper, erroneous or invalid alerts are removed using Fuzzy C_Means (FCM) algorithm, then attack scenario is found according to causal analysis and attack scenario is restored. Experiment shows that this method can resolve attack scenario.