A complete operational architecture of alert correlation

To defend against various attacks, many security systems such as intrusion detection systems are deployed into hosts and networks to better protect digital assets. However, there are well-known problems related to the current intrusion detection systems. To better understand security threats from various sources and take appropriate response, it is necessary to perform alert correlation. This paper proposes a general alert correlation architecture, including four important components: log management, alert correlation, incident response and knowledge base system. The focus is to describe most important operations in alert correlation component. The proposed architecture includes anomaly-based analysis in alert correlation component. Different techniques for alert correlation are reviewed and compared. This study proposes that a hybrid model of multiple techniques leads to better performance of alert correlation engine.