Correlation analysis system using VA data, IDS alerts

We propose a novel framework named Correlation Analysis System (CAS) using vulnerability assessment data, IDS alerts. Traditional IDS focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there axe intensive intrusions, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. We propose CAS using vulnerability assessment data, IDS alerts to reduce false positives and negatives. This provides an effective mean to lower the number of false positives and negatives that an administrator has to deal with. It also improves the results of alert correlation systems by cleaning their input data from spurious attacks. We have developed an active verification system based on Snort and Nessus. As the current implementation stands, it is a useful tool for reducing the false alarm rate of Snort.