A Model of Alerts Clustering and Association for Network Security Systems
Xuping Tu · Computer Engineering and Science · 2005
Aiming at the problem that there are generally a great deal of redundant alerts in network security systems,this paper proposes a new transaction model which clusters the alerts by means of similarity evaluation and a hierarchical mechanism to reduce the amount of alerts efficiently.In addition,this model mines the potential correlation of alerts and produces new rules via association analysis, which will be helpful in recognizing new attack patterns and improving the efficiency of clustering.