TRINETR: Facilitating Alerts Analysis and Response Decision Making

Due to many inherent deficiencies and flaws, current intrusion detection systems (IDS) are plagued by numerous problems. Intrusion Detection Systems are often inefficient and ineffective when used alone. IDS products need to be fully integrated into the security defense line. Intrusion alert analysis and management are crucial in achieving this. In this paper, we describe an intrusion detection alert management and analysis system, called TRINETR, which can serve as a layer above IDS to make the use of IDS more efficient and intrusion alerts more accurate and meaningful as well as provide real time security decision making support. Implementation and Testing of a prototype system are also presented in this paper.