关键词: 入侵检测, 数据挖掘, 报警关联, 网络安全

Abstract: Intrusion detection technology can remedy effectively the shortcoming of firewall by obtaining the alert information of network attacks, and detecting, analyzing and dynamically defending in according with network security. It is an important research task of intrusion detection technology that improving the detection and accuracy rate by effectively dealing with network alerts information. This paper proposes a novel method of network alert correlation based on real-time increment mining. In this method, the procession of alert aggregation, alert correlation and alert analysis is carried out in the small scale scope. This method effectively overcomes the shortcoming of some data mining methods applied the intrusion detection process, such as： multi-scanning; high false positive rate; low association rate in the alerts information. The experimental results show that this method not only can treat large capacity network alerts information, but also reflects the good performance in the alerts information analysis and alerts event reduction.

Key words: intrusion detection, data mining, alert association, network security