Classifying security alerts from multiple sensors based on hybrid approach

Abstract

Protecting and assuring confidential information on the internet is a crucial need. Many organizations have installed multiple security sensors for complete monitoring and detection (for example the deployment of network-based Intrusion Detection Systems (NIDSs) in a distributed network). In effect, an enormous number of alerts are generated in a different kind of formats. This overburden the Security Analyst (SA) to conduct manual alert correlation (AC) since it would be tedious, labour intensive and worst, error prone.