An IDS Alert Aggregation Method Based on Clustering
How to aggregate and reduce duplicated alerts is one of the most important tasks in IDSs. This paper proposed an alert aggregation method, which clustering similar alerts into a hyper alert based on category and feature similarity. For each feature we define an appropriate similarity function. The overall similarity is weighted by a specifiable expectation of similarity. Experiments on DARPA2000 data set have demonstrated the effectiveness of this method.
Helen Zhang, Gang Shen and David Jin
Q. H. Zheng et al., "An IDS Alert Aggregation Method Based on Clustering", Advanced Materials Research, Vols. 219-220, pp. 156-159, 2011