Alert processing based on attack graph and multi-source analyzing - Wei-xin LIU; Kang-feng ZHENG; Bin WU; Yi-xian YANG (Tongxin xuebao)
Current attack graph-based alert correlation cannot deal with graph relation between alerts properly,and a large number of redundant attack paths may arise when trying to find out missing alerts and predict future attacks.A multi-source alert analyzing method was proposed,fully utilizing graph relation and threshold to correlate mapped alerts and eventually reduce false positive rate as well as true negative rate.To improve the speed of the algorithm,a parallel alert processing system (AG-PAP) was proposed.AG-PAP is tested on distributed environment which gets satisfied effec-tiveness and performance.