Alert Correlation Algorithms: A Survey and Taxonomy
Seyed Ali Mirheidari, Sajjad Arshad, Rasool Jalili · 2016
Abstract. Alert correlation is a system which receives alerts from heterogene-ous Intrusion Detection Systems and reduces false alerts, detects high level pat-terns of attacks, increases the meaning of occurred incidents, predicts the future states of attacks, and detects root cause of attacks. To reach these goals, many algorithms have been introduced in the world with many advantages and disad-vantages. In this paper, we are trying to present a comprehensive survey on al-ready proposed alert correlation algorithms. The approach of this survey is mainly focused on algorithms in correlation engines which can work in enter-prise and practical networks. Having this aim in mind, many features related to accuracy, functionality, and computation power are introduced and all algorithm categories are assessed with these features. The result of this survey shows that