A subjective distance for clustering security events
Jianxin Wang, Geng Zhao, Weidong Zhang · 2005
Intrusion detection systems overload their human operators by triggering thousands of alarms per day, most of which are false positives. A clustering method, put forward by Claus Julisch, is very effective in eliminating false positives and finding the root causes. However, according to the variance related to the operators' knowledge and experience, a gap may exist between the nature of the event clusters and what the operators obtained from the resulting clusters. A subjective distance, different from the objective distance defined by Julisch, is proposed to fill the gap by controlling the clustering process with the subjective distance.