Aggregation and Correlation of Intrusion-Detection Alerts

Abstract. This paper describes an aggregation and correlation algorithm used in the design and implementation of an intrusion-detection console built on top of the Tivoli Enterprise Console (TEC). The aggregation and correlation algorithm aims at acquiring intrusion-detection alerts and relating them together to expose a more condensed view of the security issues raised by intrusion-detection systems.

• Type: Conference
• Year: 2001
• Where: RAID
• Authors: Hervé Debar, Andreas Wespi
• Keywords: Computer Networks, Correlation Algorithm, Intrusion-detection Alerts, Intrusion-detection Console, RAID 2001