Abstract
The significances and goals of alert aggregation and correlation techniques are surveyed comprehensively in this paper. Algorithms of aggregation and correlation and their features are discussed in detail. Meanwhile, the ideas of choosing algorithms in developing the intrusion detection alert manage system are summarized, (IDAMS) are presented. The architectures of all the existing aggregation and correlation systems, with emphasis on a brief introduction of the function of the intrusion detection message exchange format (IDMEF) on alert aggregation and correlation. Finally, the future development of this research domain is presented.
| Original language | English |
|---|---|
| Pages (from-to) | 1-8 |
| Number of pages | 8 |
| Journal | Jisuanji Yanjiu yu Fazhan/Computer Research and Development |
| Volume | 43 |
| Issue number | 1 |
| DOIs | |
| Publication status | Published - Jan 2006 |
| Externally published | Yes |
Keywords
- Alert aggregation
- Alert correlation
- Intrusion detection
- Network security