An IDS Alert Aggregation Method Based on Clustering
Qiu Hua Zheng, Yi Guang Xuan, Wei Hua Hu · Advanced materials research · 2011
How to aggregate and reduce duplicated alerts is one of the most important tasks in IDSs. This paper proposed an alert aggregation method, which clustering similar alerts into a hyper alert based on category and feature similarity. For each feature we define an appropriate similarity function. The overall similarity is weighted by a specifiable expectation of similarity. Experiments on DARPA2000 data set have demonstrated the effectiveness of this method.