International Journal of Network Security & Its Applications (IJNSA) - ERA, WJCI Indexed

International Journal of Network Security & Its Applications (IJNSA) - ERA, WJCI Indexed

ISSN: 0974 - 9330 (Online); 0975 - 2307 (Print)

Webpage URL: https://airccse.org/journal/ijnsa.html

A Novel Alert Correlation Technique for Filtering Network Attacks

Jane Kinanu Kiruki1,2, Geoffrey Muchiri Muketha1 and Gabriel Kamau1, 1Murang’a University of Technology, Kenya, 2Chuka University, Kenya

Abstract

An alert correlation is a high-level alert evaluation technique for managing large volumes of irrelevant and redundant intrusion alerts raised by Intrusion Detection Systems (IDSs).Recent trends show that pure intrusion detection no longer can satisfy the security needs of organizations. One problem with existing alert correlation techniques is that they group related alerts together without putting their severity into consideration. This paper proposes a novel alert correlation technique that can filter unnecessary and low impact alerts from a large volume of intrusion. The proposed technique is based on a supervised feature selection method that usesclass type to define the correlation between alerts. Alerts of similar class type are identified using a class label. Class types are further classified based on their metric ranks of low, medium and high level. Findings show that the technique is able detect and report high level intrusions.

Keywords

Alert correlation, merging, classification, alert clustering, alert prioritization, pre-processing

Abstract URL: http://aircconline.com/abstract/ijnsa/v15n3/15323ijnsa03.html

Original Source URL: https://aircconline.com/ijnsa/V15N3/15323ijnsa03.pdf

Volume URL: https://airccse.org/journal/jnsa23_current.html