Abstract:Security equipment such as intrusion prevention system is an important supplementary for security management. They reduce the difficulty of network management by giving alarms corresponding to different attacks instead of raw traffic packet inspection. But there are many false alarms due to their running mechanism, which greatly reduces its usability. In this paper, we develop a hierarchical framework to mine high threating alarms from the massive alarm logs, and aim to provide fundamental and useful information for administrators to design efficient management policy. First, the alarms are divided into two parts based on their attributes, the first part mainly includes several kinds of famous attacks which are critical for security management, we proposed a similar alarm mining method based on Choquet integral to cluster and rank the frequently occurred attacks. The rest alarms constitute the second part, which are caused by the potential threats attacks, also include many false alarms. To reduce the effect of false alarms and rank the potential threats, we employ the frequent pattern mining algorithm to mine correlation rules and then filter false alarms. Following, we proposed a self-adapting threat degree calculation method to qualify the threat degree of these alarms after filtering. To verity the methods developed, an experimental platform is constructed in the campus network of Xi'an Jiaotong University. Experimental results based on the data collected verify the efficiency of the developed methods. For the first kind of alarms, the similar alarms mining accuracy is higher than 97% and the alarms are ranked with different processing urgencies. For the rest alarms, the proposed methods have filtering accuracy above 80% and can rank the potential threats. Based on the ranking results, administrators can deal with the high threats with their limited time and energy, in turn, keep the network under control.

Ids Alarms Reduction Using Data Mining

Study of Adaptive Intrusion Detection with Data Mining

Research on Data Mining-based Intrusion Detection in Real-time Environment

Using Data Mining Algorithms for Developing a Model for Intrusion Detection System (IDS)

A Novel Data Mining-Based Method for Alert Reduction and Analysis.

Minining Intrusion Detection Alarms with an Sa-Based Clustering Approach

High Threat Alarms Mining for Effective Security Management: Modeling, Experiment and Application

Application of Singular Spectrum Analysis to the Noise Reduction of Intrusion Detection Alarms.

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Intrusion Scenarios Detection Based on Data Mining

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Modified Aquila Optimizer Feature Selection Approach and Support Vector Machine Classifier for Intrusion Detection System

Processing Intrusion Detection Alerts in Large-scale Network

Alert reduction for network intrusion detection

An empirical evaluation for the intrusion detection features based on machine learning and feature selection methods

Relevant Feature Selection Model Using Data Mining for Intrusion Detection System

Enhanced Intrusion Detection Systems Performance with UNSW-NB15 Data Analysis

Study of Intrusion Detection Based on Alarm Deviation Analysis

An Effective High Threating Alarm Mining Method for Cloud Security Management

A Hybrid Intrusion Detection Model Using EGA-PSO and Improved Random Forest Method