A Comparative Study of Alert Correlations for Intrusion Detection

摘要: The prevalent use of computer applications and communication technologies has rising the numbers network intrusion attempts. These malicious attempts including hacking, botnets works are pushing organization networks to a risky atmosphere where intruder tries compromise confidentiality, integrity availability resources. In order detect these activities, Intrusion Detection Systems (IDSs) have been widely deployed in corporate networks. IDSs play an important role monitoring traffic behaviors network, identifying anomalous activity notifying security analyst with current status. Unfortunately, one IDSs' drawbacks is they produce large number false positives non-relevant alerts that could overwhelm analyst. Therefore, process analyzing provide more synthetic high-level view attempted intrusions needed. This called Alert Correlation. this paper, we present commonly used alert correlation approaches highlight their advantages disadvantages from various perspectives. Subsequently, summarize some models approach.