An IDS Alert Fusion Approach Based on Happened Before Relation

Alert fusion is a process that analyzes the alerts produced by one or more intrusion detection systems and provides a more succinct and high-level view of security event or attempted intrusions. Unfortunately, the serialized alerts by detected or created time will hide the intrinsic order between alerts. It is a disadvantage to alert fusion. In this paper, we proposed an alert fusion method based on a happened before relation, which revealed the intrinsic order between alerts. Utilizing the happened before relation can improve the performance of alert correlation and reduce the interference with other correlation components. The experiment results show that our approach is effective in achieving alert reduction and aggregation.