An Automatic Alert Unification Method for Heterogeneous Alert Signatures

Several monitoring systems are usually composed by heterogeneous monitoring sensors. Each sensor raises thousands of alerts to be saved and analyzed in a centralized station. Most of alerts raised by different sensors are almost the same but have various formats and various descriptions. The system administrator must identify manually similar alerts in order to decrease the number of generated alerts and to improve the data quality. This paper proposes an alert unification method that automatically creates meta-alerts from a set of heterogeneous alert sets coming from different security monitoring sensors. Instead of dealing with several sets of alerts, this method allows the administrator to use a unique set of meta-alerts.