Data Fusion Support for Intrusion Detection and Prevention

Our main purpose for this work is to examine how to integrate multiple intrusion detection sensors in the order to minimize the number of incorrect-alarms The first problem is how to integrate data from multiple sensors, and the second how to identify most important data provided by multiple sensors. We are currently developing series of analytical models to use potential benefits of multiple sensors for reducing false alarms. The purpose of this presentation is to discuss implementation of prototype multisensor based intrusion detection system. We are especially interested in analyzing traffic that has an abnormal or malicious character and should prompt a closer look. A specific feature of the model is that the systems use multiple sensors to process log files