SOM and PSO Based Alerts Clustering in Intrusion Detection System

Abstract:

With the growing deployment of host and network intrusion detection systems (IDSs), thousands of alerts are generally generated from them per day. Managing these alerts becomes critically important. In this paper, a hybrid alert clustering method based on self-Organizing maps (SOM) and particle swarm optimization (PSO) is presented. We firstly select the important features through binary particle swarm optimization (BPSO) and mutual information (MI) and get a dimension reduced dataset. SOM is used to cluster the dataset. PSO is used to evolve the weights for SOM to improve the clustering result. The algorithm is based on a type of unsupervised machine learning algorithm that infers relationships from data without the need to train the algorithm with expertly labelled data. The approach is validated using the 2000 DARPA intrusion detection datasets and comparative results between the canonical SOM and our scheme are presented.

• Periodical: Applied Mechanics and Materials (Volumes 401-403)
• Pages: 1453-1457
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.401-403.1453
• Online since: September 2013
• Authors: Yong Wen Jing, Li Fen Li
• Keywords: Alerts Clustering, Feature Subset Selection, Particle Swarm Optimization (PSO), Self-Organizing Maps

References

[1] Cuppens, F. 2001. Managing alerts in a multi-intrusion detection environment. In Proceedings of the 17th Annual Computer Security Applications Conference.

DOI: 10.1109/acsac.2001.991518

[2] Julisch, K., Dacier, M.: Mining intrusion detection alarms for actionable knowledge. In: Proceedings of SIGKDD 2002, the 8th International Conference on Knowledge Discovery and Data Mining, Edmonton, Alberta, Canada, July 2002, p.366–375. ACM Press, New York (2002).

DOI: 10.1145/775047.775101

[3] Valdes, A., Skinner, K.: Probabilistic alert correlation. In: Lee, W., M´e, L., Wespi, A. (eds. ) RAID 2001. LNCS, vol. 2212, p.54–68. Springer, Heidelberg (2001).

[4] Sunu Mathew, Daniel Britt, Richard Giomundo, Shambhu Upadhyaya: Real-time multistage attack awareness through enhanced intrusion alert clustering. Military Communications Conference, 2005. MILCOM 2005. IEEE 17-20 Oct. 2005 Page(s): 1801 - 1806 Vol. 3.

DOI: 10.1109/milcom.2005.1605934

[5] Xiao X, Dow E, Eberhart R, Miled Z, Oppelt R (2004) A hybrid selforganizing maps and particle swarm optimization approach. Concur Comput Pract Exp 16(9): 895–915.

DOI: 10.1002/cpe.812

[6] Kohonen T: The SOM methodology In Deboeck G, Kohonen TVisual explorations in finance with self-organizing maps. Springer, Berlin.

[7] Michael O'Neill, Anthony Brabazon: Self-organising swarm (SOSwarm). Soft Comput (2008) 12: 1073–1080.

DOI: 10.1007/s00500-007-0274-8

[8] Y. Shi, R. Eberhart, Parameter Selection in Particle Swarm Optimization, Evolutionary Programming VII: Proceedings of EP 98, 591-600, (1998).

DOI: 10.1007/bfb0040810

[9] Kennedy, J. E., Eberhart, R. C.: A Binary Version of the Particle Swarm Algorithm. IEEE International Conference on Systems, Man, and Cybernetics. 5(1997)4104-4105.

DOI: 10.1109/icsmc.1997.637339

[10] Ding C , Peng H C. Minimum Redundancy Feature Selection f rom Microarray Gene Expression Data. In : Proc. IEEE Computer Soc. Bioinformatics Conf . (CSB 03) , IEEE CS Press , 2003. 523～528.

DOI: 10.1109/csb.2003.1227396

[11] Lippmann, R., Haines, J.W., Fried, D.J., Korba, J., Das, K.: The 1999 darpa off-line intrusion detection evaluation. Computer Networks 34(4), 579–595 (2000).

DOI: 10.1016/s1389-1286(00)00139-0

[12] Kohonen, Teuvo, Hynninen, Jussi, Kangas, Jari, and Laaksonen, Jorma. The Self-Organizing Map Program Package. Helsinki University of Technology, Laboratory of Computer and Information Science.