Intelligent Clustering with PCA and Unsupervised Learning Algorithm in Intrusion Alert Correlation

摘要：

As security threats advance in a drastic way, most of the organizations implement multiple Network Intrusion Detection Systems (NIDSs) to optimize detection and to provide comprehensive view of intrusion activities. But NIDSs trigger a massive amount of alerts even for a day and overwhelmed security experts. Thus, automated and intelligent clustering is important to reveal their structural correlation by grouping alerts with common attributes. We propose a new hybrid clustering model based on Improved Unit Range (IUR), Principal Component Analysis (PCA) and unsupervised learning algorithm (Expectation Maximization) to aggregate similar alerts and to reduce the number of alerts. We tested against other unsupervised learning algorithms to validate the performance of the proposed model. Our empirical results show using DARPA 2000 dataset the proposed model gives better results in terms of the clustering accuracy and processing time.

关键词： alert correlation alert clustering unsupervised learning PCA Ezpectation Mazimization

作者: Maheyzah Md Siraj Mohd Aizaini Maarof Siti Zaiton Mohd Hashim

作者单位: Faculty of Computer Science and Information Systems Universiti Teknologi Malaysia 81310 Skudai Johor,Malaysia

会议类型: 国际会议

会议名称: The Fifth International Conference on Information Assurance and Security(第五届信息保障与安全国际会议)

会议地点: 西安

会议语种:英文

页码: 679-682

在线出版日期: 2009-08-18（万方平台首次上网日期，不代表论文的发表时间）