An attack pattern mining algorithm based on fuzzy logic and sequence pattern
Yang Li, Ying Xue, Yuangang Yao, Xianghui Zhao, Jianyi Liu, Ru Zhang · 2016
How to get the correlation rules is one of the main challenges in alert correlation research fields. In this paper, we propose an attack pattern mining algorithm to solve this problem. Our method can be divided into two steps: Fast Fuzzy Cluster Analysis (FFCA) and Frequent Sequence Mining (FSM). FFCA can accurately describe the similarity among the alerts attributes accurately, while FSM can dig the correlation between alerts. In order to find the hidden attack patterns behind massive data efficiently and accurately, we combines the characteristics and advantages of them in our method. At first we design the similarity function for each attribute and separate the raw sequence into alert cluster sets through fuzzy cluster based on the similarity function. Then we dig the Frequent Sequences from these cluster sets. Finally we use experiment results to show the feasibility of our method.