A Model-based Survey of Alerts Correlation Techniques
Date
2013-04
Authors
Salah, Saeed
Maciá Fernández, Gabriel
Díaz-Verdejo, J. E.
Journal Title
Journal ISSN
Volume Title
Publisher
Computer Networks - Elsevier
Abstract
As telecommunication networks evolve rapidly in terms of scalability, complexity, and heterogeneity, the efficiency of fault localization procedures and the accuracy in the detection of anomalous behaviors are becoming important factors that largely influence the decision making process in large management companies. For this reason, telecommunication companies are doing a big effort investing in new technologies and projects aimed at finding efficient management solutions. One of the challenging issues for network and system management operators is that of dealing with the huge amount of alerts generated by the managed systems and networks. In order to discover anomalous behaviors and speed up fault localization processes, alert correlation is one of the most popular resources. Although many different alert correlation techniques have been investigated, it is still an active research field. In this paper, a survey of the state of the art in alert correlation techniques is presented. Unlike other authors, we consider that the correlation process is a common problem for different fields in the industry. Thus, we focus on showing the broad influence of this problem. Additionally, we suggest an alert correlation architecture capable of modeling current and prospective proposals. Finally, we also review some of the most important commercial products currently available.
Description
Keywords
Alert correlation , Network management systems , Fault localization , Intrusion detection systems , SCADA systems
Citation
Salah, S., Maciá-Fernández, G., & Díaz-Verdejo, J. E. (2013). A model-based survey of alert correlation techniques. Computer Networks, 57(5), 1289-1317.