Alerts Clustering for Intrusion Detection Systems: Overview and Machine Learning Perspectives

Abstract

The tremendous amount of the security alerts due to the high-speed alert generation of high-speed networks make the management of intrusion detection computationally expensive. Evidently, the high-level rate of wrong alerts disproves the Intrusion Detection Systems (IDS) performances and decrease its capability to prevent cyber-attacks which lead to tedious alert analysis task. Thus, it is important to develop new tools to understand intrusion data and to represent them in a compact forms using, for example, an alert clustering process. This hot topic of research is studied here and an understandable taxonomy followed by a deep survey of main published works related to intrusion alert management is presented in this paper. The second part of this work exposes different useful steps for designing a unified IDS system on the basis of machine learning techniques which are considered one of the most powerful tools for solving certain problems related to alert management and outlier detection.

Wk-fnn design for detection of anomalies in the computer network traffic

“…At the same time, they find a lot of time is wasted in investing in non-serious warnings (low precision), but many serious alerts are still lost. In [33] the authors divide alerts into low-and high-level alerts and point out that high-level alert management is a potential task that helps the administrator to analyze alerts correctly and to allocate time and effort.…”

An Effective Attack Scenario Construction Model based on Attack Steps and Stages Identification

“…Alert Correlation (AC) is the core of the attack scenario construction process. AC takes a set of alerts produced by one or more NIDSs as input and generates a highlevel view of occurring or attempted intrusions [7]. It finds and discovers the relationships among unrelated alerts and their attributes that reveal the behavior of the attacker by finding similarity or causality between the alerts [3] and [11].…”

“…However, the Security Analyst (SA) cannot capture the logical steps or scenarios behind these attacks, due to fact that the NIDS triggers alerts independently in low-level information that describes individual attack steps and are not designed to recognize the attack plans or discover multistage attack scenarios [5]. Therefore, identifying the scenario of the attack directly from these alerts is unmanageable due to problems with detailing a low level of information [6] [7]. Existing works on attack scenario construction mainly either rely on knowledge-based methods to find the relation between alerts or aim to make an inference from statistical or machine learning analysis, which are more complex and higher in computational cost.…”