Abstract:Security equipment such as intrusion prevention system is an important supplementary for security management. They reduce the difficulty of network management by giving alarms corresponding to different attacks instead of raw traffic packet inspection. But there are many false alarms due to their running mechanism, which greatly reduces its usability. In this paper, we develop a hierarchical framework to mine high threating alarms from the massive alarm logs, and aim to provide fundamental and useful information for administrators to design efficient management policy. First, the alarms are divided into two parts based on their attributes, the first part mainly includes several kinds of famous attacks which are critical for security management, we proposed a similar alarm mining method based on Choquet integral to cluster and rank the frequently occurred attacks. The rest alarms constitute the second part, which are caused by the potential threats attacks, also include many false alarms. To reduce the effect of false alarms and rank the potential threats, we employ the frequent pattern mining algorithm to mine correlation rules and then filter false alarms. Following, we proposed a self-adapting threat degree calculation method to qualify the threat degree of these alarms after filtering. To verity the methods developed, an experimental platform is constructed in the campus network of Xi'an Jiaotong University. Experimental results based on the data collected verify the efficiency of the developed methods. For the first kind of alarms, the similar alarms mining accuracy is higher than 97% and the alarms are ranked with different processing urgencies. For the rest alarms, the proposed methods have filtering accuracy above 80% and can rank the potential threats. Based on the ranking results, administrators can deal with the high threats with their limited time and energy, in turn, keep the network under control.

Research topics of intelligent alarm management

Alarm management techniques to improve process safety

Survey on Advanced Alarm Strategies Based on Multivariate Analysis

Design of the Intelligent Alarm System for Chemical Processes

Engineering Demand for Smart Alarm Management in Large-Scale Industrial Processes

An Overview of Industrial Alarm Systems: Main Causes for Alarm Overloading, Research Status, and Open Problems

Multivariate Industrial Alarm Design Based on Quantitative and Dynamic Risk Assessment

Design and Realization of Substation-Control Center Two Level Distributed Alarming System

Analysis and improvement of process industrial alarm systems traditional assessment methods

A Multi-Setpoint Delay-Timer Alarming Strategy for Industrial Alarm Monitoring

Design And Analysis Of Improved Alarm Delay-Timers

A Review Of Alarm System Design For Advanced Control Rooms Of Nuclear Power Plants

Survey on Alarm Processing Technology in Power System

Adaptive Design of Uni-Variate Alarm Systems Based on Statistical Distance Measures

Assessment of Alarm Systems for Mixture Processes and Intermittent Faults

Adaptive Design of Alarm Systems in Industrial Processes

A review of alarm root cause analysis in process industries: Common methods, recent research status and challenges

Data-based identification of the related alarms in the process industries

Correlation Analysis of Alarm Data and Alarm Limit Design for Industrial Processes

An Effective High Threating Alarm Mining Method for Cloud Security Management

Development of Intelligent Alarm System