ISSN 1000-1239 CN 11-1777/TP

• Paper • Previous Articles     Next Articles

An Adaptive Alert Correlation Method Based on Pattern Mining and Clustering Analysis

Tian Zhihong1,2, Zhang Yongzheng2, Zhang Weizhe1, Li Yang3, and Ye Jianwei1   

  1. 1(School of Computer Science and Technology, Harbin Institute of Technology, Harbin 150001) 2(Research Center of Information Intelligence and Information Security, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190) 3(Institute of Network Technology, Research Institution of China Mobile, Beijing 100053)
  • Online:2009-08-15

Abstract: Multi-step attack is one of the primary forms of the current attacks. There are some relationships among each step of attacks, such as redundancy relationship and causality relationship. But the relationships among security events are often ignored by the current intrusion detection systems (IDS), and an important problem in the field of IDS is a large volume of false positive which tends to overwhelm human operators. On the basis of analyzing the evolution and drawbacks of current alert correlation systems, a self-adapted alarming association method, A3PC, is presented based on anomaly detection ideas and centering on the concept of behavior patterns generated by alerts. The alert classification model is created by extracting association rules and series patterns in order to automatically discriminate the false alerts. At the same time, effective and condensed alerts view for administrators can be shaped based on the combinative idea of pattern mining and clustering analysis and the semiautomatic interactive processing approach. The accuracy of intrusion detection systems is thus enhanced. The DARPA intrusion scenario dataset from MIT Lincoln Lab is used to evaluate the function and performance of A3PC. The experiments results indicate that A3PC is superior to the traditional methods in accuracy, real-time and adaptivity.

Key words: intrusion detection, alert correlation, pattern mining, clustering analysis, false positive