Hierarchical Distributed Alert Correlation Model

摘要：

Alert correlation is a promising technique in intrusion detection. It takes the alerts produced by intrusion detection systems and produces compact reports which provide a more succinct and high-level view of occurring or attempted intrusions and highly improve security experts work efficiency. Traditional alert correlation system adopts a centralized architecture which can be easily over flooded by the raw alarms. To address this issue, a distributed alert correlation model based on hierarchical architecture is proposed. This model greatly improves the performance of alert correlation through integrating three novel methods. The experiments show effectiveness of this alert correlation model on 2000 DARPA intrusion detection scenario specific datasets.

关键词： intrusion detection hierarchical model distributed alert correlation

作者: Donghai Tian Hu Changzhen Yang Qi Wang Jianqiao

作者单位: Lab for Computer Network Defense Technology Beijing Institute of Technology Beijing,China Lab for Database & Network Computing South China University of Technology Guangzhou,China Zhejiang Education Institute Hangzhou,China

会议类型: 国际会议

会议名称: The Fifth International Conference on Information Assurance and Security(第五届信息保障与安全国际会议)

会议地点: 西安

会议语种:英文

页码: 765-768

在线出版日期: 2009-08-18（万方平台首次上网日期，不代表论文的发表时间）