A Novel Alert Correlation Technique for Filtering Network Attacks
View/ Open
Date
2023-05Author
Kiruki, Jane K.
Muketha, Geoffrey M.
Kamau, Gabriel
Metadata
Show full item recordAbstract
An alert correlation is a high-level alert evaluation technique for managing large volumes of irrelevant and redundant intrusion alerts raised by Intrusion Detection Systems (IDSs).Recent trends show that pure intrusion detection no longer can satisfy the security needs of organizations. One problem with existing alert correlation techniques is that they group related alerts together without putting their severity into consideration. This paper proposes a novel alert correlation technique that can filter unnecessary and low impact alerts from a large volume of intrusion. The proposed technique is based on a supervised feature selection method that uses class type to define the correlation between alerts. Alerts of similar class type are identified using a class label. Class types are further classified based on their metric ranks of low, medium and high level. Findings show that the technique is able detect and report high level intrusions.
URI
chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://aircconline.com/ijnsa/V15N3/15323ijnsa03.pdfhttps://typeset.io/papers/a-novel-alert-correlation-technique-for-filtering-network-30dhpusb
https://www.youtube.com/watch?v=bNiMG-JqhWc
http://repository.mut.ac.ke:8080/xmlui/handle/123456789/6434
https://doi.org/10.5121/ijnsa.2023.15303
Collections
- Journal Articles (CI) [105]