Intrusion Alert Correlation Technique Analysis for Heterogeneous Log
Intrusion alert correlation is multi-step processes that receives alerts from heterogeneous log resources as input and produce a high-level description of the malicious activity on the network. The objective of this study is to analyse the current alert correlation technique and identify the signifi...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Dr. Sang H. Lee
2008
|
| Subjects: | |
| Online Access: | http://eprints.utem.edu.my/id/eprint/59/ http://eprints.utem.edu.my/id/eprint/59/1/20080919-accepted.pdf |
| _version_ | 1848886879927140352 |
|---|---|
| author | Yusof, R. Selamat, S. R. Sahib, S. |
| author_facet | Yusof, R. Selamat, S. R. Sahib, S. |
| author_sort | Yusof, R. |
| building | UTeM Institutional Repository |
| collection | Online Access |
| description | Intrusion alert correlation is multi-step processes that receives alerts from heterogeneous log resources as input and produce a high-level description of the malicious activity on the network. The objective of this study is to analyse the current alert correlation technique and identify the significant criteria in each technique that can improve the Intrusion Detection System(IDS) problem such as prone to alert flooding, contextual problem, false alert and scalability. The existing alert correlation techniques had been reviewed and analysed. From the analysis, six capability criteria have been identified to
improve the current alert correlation technique. They are
capability to do alert reduction, alert clustering,identify multistep attack, reduce false alert, detect known attack and detect unknown attack. |
| first_indexed | 2025-11-15T19:45:31Z |
| format | Article |
| id | utem-59 |
| institution | Universiti Teknikal Malaysia Melaka |
| institution_category | Local University |
| language | English |
| last_indexed | 2025-11-15T19:45:31Z |
| publishDate | 2008 |
| publisher | Dr. Sang H. Lee |
| recordtype | eprints |
| repository_type | Digital Repository |
| spelling | utem-592021-09-19T16:53:38Z http://eprints.utem.edu.my/id/eprint/59/ Intrusion Alert Correlation Technique Analysis for Heterogeneous Log Yusof, R. Selamat, S. R. Sahib, S. Q Science (General) Intrusion alert correlation is multi-step processes that receives alerts from heterogeneous log resources as input and produce a high-level description of the malicious activity on the network. The objective of this study is to analyse the current alert correlation technique and identify the significant criteria in each technique that can improve the Intrusion Detection System(IDS) problem such as prone to alert flooding, contextual problem, false alert and scalability. The existing alert correlation techniques had been reviewed and analysed. From the analysis, six capability criteria have been identified to improve the current alert correlation technique. They are capability to do alert reduction, alert clustering,identify multistep attack, reduce false alert, detect known attack and detect unknown attack. Dr. Sang H. Lee 2008-09-30 Article PeerReviewed application/pdf en http://eprints.utem.edu.my/id/eprint/59/1/20080919-accepted.pdf Yusof, R. and Selamat, S. R. and Sahib, S. (2008) Intrusion Alert Correlation Technique Analysis for Heterogeneous Log. International Journal of Computer Science and Network Security , 8 (9). pp. 132-138. ISSN 1738-7906 http://www.ijcsns.org/ |
| spellingShingle | Q Science (General) Yusof, R. Selamat, S. R. Sahib, S. Intrusion Alert Correlation Technique Analysis for Heterogeneous Log |
| title | Intrusion Alert Correlation Technique Analysis for Heterogeneous Log |
| title_full | Intrusion Alert Correlation Technique Analysis for Heterogeneous Log |
| title_fullStr | Intrusion Alert Correlation Technique Analysis for Heterogeneous Log |
| title_full_unstemmed | Intrusion Alert Correlation Technique Analysis for Heterogeneous Log |
| title_short | Intrusion Alert Correlation Technique Analysis for Heterogeneous Log |
| title_sort | intrusion alert correlation technique analysis for heterogeneous log |
| topic | Q Science (General) |
| url | http://eprints.utem.edu.my/id/eprint/59/ http://eprints.utem.edu.my/id/eprint/59/ http://eprints.utem.edu.my/id/eprint/59/1/20080919-accepted.pdf |