Probabilistic Alert Correlation

10 years 11 months ago
Probabilistic Alert Correlation
With the growing deployment of host and network intrusion detection systems, managing reports from these systems becomes critically important. We present a probabilistic approach to alert correlation, extending ideas from multisensor data fusion. Features used for alert correlation are based on alert content that anticipates evolving IETF standards. The probabilistic approach provides a unified mathematical framework for correlating alerts that match closely but not perfectly, where the minimum degree of match required to fuse alerts is controlled by a single configurable parameter. Only features in common are considered in the fusion algorithm. For each feature we define an appropriate similarity function. The overall similarity is weighted by a specifiable expectation of similarity. In addition, a minimum similarity may be specified for some or all features. Features in this set must match at least as well as the minimum similarity specification in order to combine alerts, regardless...
Alfonso Valdes, Keith Skinner
Added 30 Jul 2010
Updated 30 Jul 2010
Type Conference
Year 2001
Where RAID
Authors Alfonso Valdes, Keith Skinner
Comments (0)