Universiti Teknologi Malaysia Institutional Repository

Intelligent alert clustering model for network intrusion analysis

M. S., Maheyzah and M., Mohd. Aizaini and M. H. , Siti Zaiton (2009) Intelligent alert clustering model for network intrusion analysis. Journal in Advances Soft Computing and Its Applications (IJSCA), 1 (1). pp. 33-48. ISSN 2074-8523

Full text not available from this repository.

Official URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumbe...

Abstract

As security threats advance in a drastic way, most of the organizations implement multiple Network Intrusion Detection Systems (NIDSs) to optimize detection and to provide comprehensive view of intrusion activities. But NIDSs trigger a massive amount of alerts even for a day and overwhelmed security experts. Thus, automated and intelligent clustering is important to reveal their structural correlation by grouping alerts with common attributes. We propose a new hybrid clustering model based on Improved Unit Range (IUR), Principal Component Analysis (PCA) and unsupervised learning algorithm (Expectation Maximization) to aggregate similar alerts and to reduce the number of alerts. We tested against other unsupervised learning algorithms to validate the performance of the proposed model. Our empirical results show using DARPA 2000 dataset the proposed model gives better results in terms of the clustering accuracy and processing time.

Item Type:Article
Uncontrolled Keywords:alert correlation, alert clustering, unsupervised learning, PCA, expectation maximization
Subjects:Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Q Science > QA Mathematics > QA76 Computer software
Divisions:Computer Science and Information System (Formerly known)
ID Code:11834
Deposited By: Nor Asmida Abdullah
Deposited On:21 Jan 2011 10:24
Last Modified:21 Jan 2011 10:24

Repository Staff Only: item control page