• Jun 14, 2017 News!Vol.8, No.5 has been indexed by EI (Inspec).   [Click]
  • Nov 09, 2017 News!Vol.9, No.5 has been published with online version. 16 peer reviewed articles from 11 specific areas are published in this issue.   [Click]
  • Jul 19, 2017 News!Vol.9, No.4 has been published with online version. 16 peer reviewed articles from 16 specific areas are published in this issue.   [Click]
General Information
Editor-in-chief
Prof. Wael Badawy
Department of Computing and Information Systems Umm Al Qura University, Canada
I'm happy to take on the position of editor in chief of IJCTE. We encourage authors to submit papers concerning any branch of computer theory and engineering.
IJCTE 2009 Vol.1(5): 539-545 ISSN: 1793-8201
DOI: 10.7763/IJCTE.2009.V1.87

A Hybrid Intelligent Approach for Automated Alert Clustering and Filtering in Intrusion Alert Analysis

Maheyzah Md Siraj, Mohd Aizaini Maarof, and Siti Zaiton Mohd Hashim
Abstract—As security threats change and advance in a drastic way, most of the organizations implement multiple Network Intrusion Detection Systems (NIDSs) to optimize detection and to provide comprehensive view of intrusion activities. But NIDSs trigger a massive amount of alerts even for a day and overwhelmed security experts. Thus, automated and intelligent clustering is important to reveal their structural correlation by grouping alerts with common attributes. We propose a new hybrid clustering model based on Improved Unit Range (IUR), Principal Component Analysis (PCA) and unsupervised learning algorithm (Expectation Maximization) to aggregate similar alerts and to reduce the number of alerts. We tested against other unsupervised learning algorithms to validate the performance of the proposed model. Our empirical results show using DARPA 2000 dataset the proposed model gives better results in terms of the clustering accuracy and processing time.

Index Terms—alert clustering and filtering, Expectation Maximization, Principal Component Analysis, unsupervised learning.

Manuscript received June 1, 2009. This work was supported by the Ministry of Higher Education (MOHE), Malaysia.
Maheyzah Md Siraj is with the Faculty of Computer Science and Information System, Universiti Teknologi Malaysia, 81310 Skudai Johor, Malaysia. (phone: +607 5532245; fax: +607 5593185;).
Mohd Aizaini Maarof and Siti Zaiton Mohd Hashim are also with the Faculty of Computer Science and Information System, Universiti Teknologi Malaysia, 81310 Skudai Johor, Malaysia.

[PDF]

Cite: Maheyzah Md Siraj, Mohd Aizaini Maarof and Siti Zaiton Mohd Hashim, "A Hybrid Intelligent Approach for Automated Alert Clustering and Filtering in Intrusion Alert Analysis," International Journal of Computer Theory and Engineering vol. 1, no. 5, pp. 539-545, 2009.
Copyright © 2008-2015. International Journal of Computer Theory and Engineering. All rights reserved.
E-mail: ijcte@vip.163.com