MS²IFS: A Multiple Source-Based Security Information Fusion System

Security Information Fusion System has recently become one of the major topics in the research area of information security. A great deal of security devices and components have been deployed in network information systems. While improving the systems security performance, they produced lots of redundant or unreliable information. Through the technologies of alert fusion and correlation analysis, alert redundancy can be decreased, administration pressure can be reduced and alert accuracy can be raised effectively. We propose the system architecture of multi-source security information fusion (MS
²
IFS), and discuss the design ideas and algorithm implementation of MS
²
IFS key modules. The results of testing on offline alert logs and online simulated attack data proved the feasibility and validity of MS
²
IFS system and satisfied the design requirement, presenting preferable.