Abstract:

According to the researches of traditional network intrusion detection, we proposed a multistep intrusion alert collaborative model based on data mining, by which the alert information of several intrusion detection systems can be integrated so as to find the inner contacts by analysing the massive, disordered alert information, the attack alert can be simplified, and the multistep intrusion in the integrated alert information can be found through the constantly updated knowledge database. Comparison of the model with the existing model shows that the correlation analysis method of this model and the build of the multistep intrusion knowledge base really do help to the combination of the characteristics of different systems so as to realize multistep intrusion alert collaborative researches.

Key words:  data mining, anomaly detection, multistep intrusion, alert correlation model