Reliable Alert Fusion of Multiple Intrusion Detection Systems

Alert Fusion is a process of combining alerts from multiple Intrusion Detection Systems to make a decision about the presence of attack or intrusion. A reliable decision from an alert fusion requires that Intrusion detectors involved in the fusion process generates fully reliable alerts. The unreliable alerts from intrusion detectors may completely misleads the decision making process. The existing alert fusion operators doesn’t incorporate reliability of Intrusion detectors. In this work, we have proposed a novel alert fusion method which overcomes the limitations of existing fusion methods and fulfils the requirements for alert fusion domain. We have demostrated the results for two different approaches of deriving reliability value of intrusion system detector which are based on conflict and true positive rate of intrusion detectors. The results shows the robustness of proposed rule in fusing alerts from multiple intrusion detection system. Our proposed approach shows a drastic reduction in false positive rate without affecting the true positive rate.