An Intrusion Alert Correlation Approach Based on Finite Automata

摘要：

Intrusion alert analysis system correlates alerts that generated by one or more IDS(s), and yields a succinct attack scenario which reflects an intrusion process. This paper presents an intrusion alert analysis model consists of four modules: alert formalization, alert filtering, alert fusion and correlation, and scenario visualization. Alerts are fused and correlated using approach based on finite automata. Three kinds of high-level views of attacks are generated, i.e. process-critical scenario, attacker-critical scenario, and victim-critical scenario. Experiments show that the approach can reduce the redundancy of intrusion alerts and correlate them well.

关键词： alert correlation alert fusion IDS finite automaton

作者: Lei Liu KangFeng Zheng YiXianYang

作者单位: Key Laboratory of network and information attack & defence technology of MOE, Beijing University of Posts and Telecommunications Beijing, China

会议类型: 国际会议

会议名称: 2010 International Conference on Communications and Intelligence Information Security(2010年国际信息与智能安全学术会议 ICCIIS2010)

会议地点: 南宁

会议语种:英文

页码: 80-83

在线出版日期: 2010-10-13（万方平台首次上网日期，不代表论文的发表时间）