Dandy Pramana Hostiadi, Made Darma Susila, Roy Rudolf Huizen
{"title":"A New Alert Correlation Model Based On Similarity Approach","authors":"Dandy Pramana Hostiadi, Made Darma Susila, Roy Rudolf Huizen","doi":"10.1109/ICORIS.2019.8874899","DOIUrl":null,"url":null,"abstract":"Alerts are information generated by the Intrusion Detection System (IDS). Alert Correlation is a method to defining a high related alert and analyze alert in the high-level analysis without ignoring the information of detection. In previous research, alert correlation model was developed using pre-defined knowledge. In this research, we proposed a new model of alert correlation using similarity approach to define the correlation between alert by analyzing the feature in alert flows traffic without using pre-defined knowledge and precondition. In our model, we introduce two-step in analyzing the feature of alert flows called Low-level Alert Analysis and High-Level Alert Analysis. The result showed that our model could define 84% or 129 correlated alert pairwise from 153 alert pairwise that extracted alert flows traffic.","PeriodicalId":118443,"journal":{"name":"2019 1st International Conference on Cybernetics and Intelligent System (ICORIS)","volume":"103 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2019-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"5","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2019 1st International Conference on Cybernetics and Intelligent System (ICORIS)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ICORIS.2019.8874899","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 5
Abstract
Alerts are information generated by the Intrusion Detection System (IDS). Alert Correlation is a method to defining a high related alert and analyze alert in the high-level analysis without ignoring the information of detection. In previous research, alert correlation model was developed using pre-defined knowledge. In this research, we proposed a new model of alert correlation using similarity approach to define the correlation between alert by analyzing the feature in alert flows traffic without using pre-defined knowledge and precondition. In our model, we introduce two-step in analyzing the feature of alert flows called Low-level Alert Analysis and High-Level Alert Analysis. The result showed that our model could define 84% or 129 correlated alert pairwise from 153 alert pairwise that extracted alert flows traffic.
京公网安备 11010802042870号
京ICP备2023020795号-1
分享
求助内容：
应助结果提醒方式：
扫码关注我们
