Alert correlation using support vector machine for multi intrusion detection systems

Abstract

This paper presents a new alert correlation model for multiple intrusion detection systems. Based on the analysis of the complex relationship between the alert information of the intrusion detection system, an alert fusion model is proposed and used to alert correlation. The SVM algorithm has an advantage in the multidimensional classification, which can further reduce the influence of false positives and false negatives. The experimental results show that the alert fusion model has high accuracy and low false positive. © 2005 – ongoing JATIT & LLS.