Alert correlation in a cooperative intrusion detection framework

摘要: This paper presents the work we have done within MIRADOR project to design CRIM, a cooperative module for intrusion detection systems (IDS). implements functions manage, cluster, merge and correlate alerts. The clustering merging recognize alerts that correspond same occurrence of an attack create new alert data contained in these various Experiments show significantly reduce number However, also observe obtain are still too elementary be managed by security administrator. purpose correlation function is thus generate global synthetic focuses on approach suggest this function.