Abstract:Security equipment such as intrusion prevention system is an important supplementary for security management. They reduce the difficulty of network management by giving alarms corresponding to different attacks instead of raw traffic packet inspection. But there are many false alarms due to their running mechanism, which greatly reduces its usability. In this paper, we develop a hierarchical framework to mine high threating alarms from the massive alarm logs, and aim to provide fundamental and useful information for administrators to design efficient management policy. First, the alarms are divided into two parts based on their attributes, the first part mainly includes several kinds of famous attacks which are critical for security management, we proposed a similar alarm mining method based on Choquet integral to cluster and rank the frequently occurred attacks. The rest alarms constitute the second part, which are caused by the potential threats attacks, also include many false alarms. To reduce the effect of false alarms and rank the potential threats, we employ the frequent pattern mining algorithm to mine correlation rules and then filter false alarms. Following, we proposed a self-adapting threat degree calculation method to qualify the threat degree of these alarms after filtering. To verity the methods developed, an experimental platform is constructed in the campus network of Xi'an Jiaotong University. Experimental results based on the data collected verify the efficiency of the developed methods. For the first kind of alarms, the similar alarms mining accuracy is higher than 97% and the alarms are ranked with different processing urgencies. For the rest alarms, the proposed methods have filtering accuracy above 80% and can rank the potential threats. Based on the ranking results, administrators can deal with the high threats with their limited time and energy, in turn, keep the network under control.

An IDS Alarm Analysis Method for Intrusion Warning Based on Time Series Theory

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Research on Data Mining-based Intrusion Detection in Real-time Environment

Intrusion Detection Research Based on Alarm Information of IDS

Reducing False Positives Based on Time Sequence Analysis

Application of Singular Spectrum Analysis to the Noise Reduction of Intrusion Detection Alarms.

Study of Intrusion Detection Based on Alarm Deviation Analysis

High Threat Alarms Mining for Effective Security Management: Modeling, Experiment and Application

An Alarm Flow Decomposition Method for Security Threat Evaluation

An Entropy-based Method for Attack Detection in Large Scale Network

An alert correlating algorithm based on multi-step attack path graphs:MSACA

Network Anomaly Detection Based on Statistical Approach and Time Series Analysis

Real-Time Alert Stream Clustering and Correlation for Discovering Attack Strategies

Statistical Decision Modeling for IDS Alert Analysis

IntruDTS: Interactive Visual Analysis System for Intrusion Detection in Time Series

A New Attack Detection in Large Scale Network Based on Entropy.

An Effective High Threating Alarm Mining Method for Cloud Security Management

Research of Applying Time-Based Sequence Model to Intrusion Detection

Research of Anomaly Detection System Based on Data Mining

Network Security Situation Awareness Based on Spatio-temporal Correlation of Alarms