A distributed intrusion detect model based on alert data correlation analysis

Intrusion detects is an important method to ensure the network security and the distributed intrusion detect system can detect the intrusion of the entire network. The association analysis is practical and feasible to improve the detective performance of intrusion detection system. The paper proposes a tree-layer alert data correlation analysis model of distributed intrusion system to reduce the false alerts by analyzing the intensity of the alert data, clear or reduce the repeated alert by clustering the alert data and discover the high-level attack tactics by associating the alert data. The paper provides the algorithm of each module, and the experiment of the high-level event correlation module with the detect attack data Mitnick shows that the association based on the ontology can achieve the detection of the process of the multi-step distributed attack.