A new system to evaluate GA-based clustering algorithms in Intrusion Detection alert management system
Hadi Bahrbegi, Ahmad Habibizad Navin, Amir Azimi Alasti Ahrabi, Mirkamal Mirnia, Amir Mollanejad · 2010
Intrusion Detection Systems (IDS) allow to protect systems used by organizations against threats that emerges network connectivity by increasing. The main drawbacks of IDS are the number of alerts generated and failing. Thus in this paper an alert clustering and classification system are proposed. It is able to classify IDS alerts and reduces false positive alerts using clustering of genetic algorithms. To improve the accuracy of the proposed system alert filtering algorithm are used. To achieve the best accuracy in false positive alert reduction and true positive alert clustering and classification, several genetic algorithms are compared. In addition to the known clustering algorithms, two new clustering algorithms are introduced based on Genetic Algorithm and compared with others. By the experimental results on DARPA KDD cup 98 the system is able to cluster and classify alerts and causes reducing false positive alerts considerably.