@inproceedings{a0fc93f726164a6bb71255b32234e063,
title = "Aggregation and correlation of intrusion-detection alerts",
abstract = "This paper describes an aggregation and correlation algorithm used in the design and implementation of an intrusion-detection console built on top of the Tivoli Enterprise Console (TEC). The aggregation and correlation algorithm aims at acquiring intrusion-detection alerts and relating them together to expose a more condensed view of the security issues raised by intrusion-detection systems.",
keywords = "Alert aggregation, Alert correlation, Alert data model, Intrusion detection",
author = "Herv{\'e} Debar and Andreas Wespi",
note = "Publisher Copyright: {\textcopyright} Springer-Verlag Berlin Heidelberg 2001.; 4th International Symposium on Recent Advances in Intrusion Detection, RAID 2001 ; Conference date: 10-10-2001 Through 12-10-2001",
year = "2001",
month = jan,
day = "1",
language = "English",
isbn = "3540427023",
series = "Lecture Notes in Computer Science",
publisher = "Springer Verlag",
pages = "85--103",
editor = "Wenke Lee and Ludovic Me and Andreas Wespi",
booktitle = "Recent Advances in Intrusion Detection - 4th International Symposium, RAID 2001, Proceedings",
}