Alert Verification Based on Attack Classification in Collaborative Intrusion Detection

The traditional intrusion detection system has the disadvantages of alert flooding and high false positive due to weak collaboration-awareness. The collaborative intrusion detection mechanism is advocated to overcome shortcomings of traditional IDS and alert verification and correlation are two important techniques to perform collaborative mechanisms. The goal of alert verification is to distinguish the false positives from true positives or confirm the confidence of the alert by integrating context information of protected network with alerts. In this paper, we present an alert verification scheme based on attack classification to achieve the objectives of low cost and high efficiency of verification process.