Alert correlation using a novel clustering approach

Abstract

Since the birth of intrusion detection system (ids) technology, the most significant implementation problem is the enormous number of alerts generated by the ids sensors. moreover due to this obtrusive predicament, two other problems have emerged which are the difficulty in processing the alerts accurately and also the decrease in performance rate in terms of time and memory capacity while processing these alerts. thus, based on the specified problems, the purpose of our overall research is to construct a holistic solution that is able to reduce the number of alerts to be processed and at the same time to produce a high quality attack scenarios that are meaningful to the administrators in a timely manner. however for the purpose of this paper we will present our proposed clustering method, architectured solely with the intention of reducing the amount of alerts generated by ids. the clustering method was tested against a live data from a cyber attack monitoring unit that uses snort engine to capture the alerts. the result obtained from the experiment is very promising, the clustering algorithm was able to reduce about 86.9% of the alerts used in the experiment. from the result we are able to highlight the contribution to practitioners in an actual working environment.