Mining Attack Instances Based on Improved Evolving Self-organizing Maps
Chongzhao Han · Jisuanji fangzhen · 2007
To solve the problems of obtaining interesting attack instances from complicated alerts generated by intrusion detection system, an attack instances mining method based on improved evolving self-organizing maps (IESOM) was proposed. The initial connection strengths between the winning neure and other neures were defined on the basis of their distances in IESOM, which solve the problem of choosing the initial connection strengths in evolving self-organizing maps (ESOM). These alerts were firstly clustered using IESOM, and these clustering results were merged with the merging rule to obtain initial attack instances in attack instances mining method based on IESOM, then these significative attack instances were obtained after filtering those initial attack instances according to a few of filtering rules. The attack instances mining results on the alerts raised by XJTU-sensor show that the proposed method is effective to obtain attack instances from plentiful alerts.