A Hierarchical Alarm Processing Model for Intrusion Detection System

For the alarm flooding problem, a hierarchical alarm processing model is studied to filter, reduce and correlate alarms. In filtering, false alarms are eliminated with repository. In reduction, a reduction algorithm is designed to remove the duplicate alarms in real time. In correlation, a frequent episodes algorithm is implemented on training data to help clustering-based correlation algorithm find the intrusion patterns. Through the above processing, the false and invalid alarms are eliminated, which eases the networks system and administrator´s burden. Meanwhile, intrusion patterns can be found and alarm prediction can be reported. Experimental results show the model is effective.