Multi-Violation Detectors: An algebraic tool for Alert Correlation and Intrusion Detection

To enhance the traditional techniques of detecting distributed attacks, an algebraic tool for correlating alerts is proposed in this paper. It is mainly based on a new concept called multi-violation detectors (MvD). While MvDs allow event and alert correlation, they can be mathematically managed, constructed, and learned. The proposed method is validated at the end of the paper based on a case study