An Intrusion Alert Correlation Approach Based on Finite Automata

Intrusion alert analysis system correlates alerts that generated by one or more IDS(s), and yields a succinct attack scenario which reflects an intrusion process. This paper presents an intrusion alert analysis model consists of four modules: alert formalization, alert filtering, alert fusion and correlation, and scenario visualization. Alerts are fused and correlated using approach based on finite automata. Three kinds of high-level views of attacks are generated, i.e. process-critical scenario, attacker-critical scenario, and victim-critical scenario. Experiments show that the approach can reduce the redundancy of intrusion alerts and correlate them well.