文献类型：期刊文献

英文题名：A hierarchical alarm processing model for intrusion detection system

作者：Xiao, Lizhong[1,2,3]; Liu, Yunxiang[1]; Wu, Zhongdai[4]

机构：[1] Department of Computer Science and Information Engineering, Shanghai Institute of Technology, Shanghai, China; [2] Postdoctor Mobile Station of Control Science and Engineering, East China University of Science and Technology, Shanghai, China; [3] Postdoctor Work Station of Kunshan Software Park, Kunshan, Jiangsu, China; [4] China Shipping Information Systems Co., Ltd., Shanghai, China

年份：2009

外文期刊名：Proceedings - 2009 International Conference on Information Engineering and Computer Science, ICIECS 2009

收录：EI(收录号：20101212792161)

语种：英文

外文关键词：Alarm systems - Intrusion detection - Reduction

摘要：For the alarm flooding problem, a hierarchical alarm processing model is studied to filter, reduce and correlate alarms. In filtering, false alarms are eliminated with repository. In reduction, a reduction algorithm is designed to remove the duplicate alarms in real time. In correlation, a frequent episodes algorithm is implemented on training data to help clustering-based correlation algorithm find the intrusion patterns. Through the above processing, the false and invalid alarms are eliminated, which eases the networks system and administrator's burden. Meanwhile, intrusion patterns can be found and alarm prediction can be reported. Experimental results show the model is effective. ?2009 IEEE.