A preliminary two-stage alarm correlation and filtering system using SOM neural network and K-means algorithm

Computers and Security

Volumn 29, Issue 6, 2010, Pages 712-723

  Tjhai, Gina C ^a   Furnell, Steven M ^a   Papadaki, Maria ^a   Clarke, Nathan L ^a  

^a UNIVERSITY OF PLYMOUTH   (United Kingdom)

Author keywords

Alarm correlation; False alarm; Intrusion Detection System; K means clustering; Self Organising Map (SOM)

Indexed keywords

ALARM CORRELATION; FALSE ALARMS; INTRUSION DETECTION SYSTEMS; K-MEANS CLUSTERING; SELF-ORGANISING MAPS;

ARTS COMPUTING; COMPUTER CRIME; ERRORS; INTRUSION DETECTION; NEURAL NETWORKS; WATER SUPPLY SYSTEMS;

ALARM SYSTEMS;

EID: 77955430292     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2010.02.001     Document Type: Article

References (31)

1. A. Alharby, and H. Imai IDS false alarm reduction using continuous and discontinuous patterns Third international conference on applied cryptography and network security, ACNS, New York, United State Lecture notes in computer science vol. 3531 2005
2. Basic Analysis and Security Engine (BASE) Project 2007 http://base.secureideas.net/
3. B. Caswell, and M. Roesch Snort: the open source network intrusion detection system 2004
4. Chyssler T, Nadjm-Tehrani S, Burschka S, Burbeck K. Alarm reduction and correlation in defence of IP networks. In: Proceedings of the 13th IEEE international Workshops on enabling technologies: infrastructure for collaborative enterprises; 2004a, p. 22934.
5. T. Chyssler, S. Burschka, M. Semling, T. Lingvall, and K. Burbeck Alarm reduction and correlation in intrusion detection systems 2004 The Department of Computer and Information Science Linkopings Universitet Available via:
6. CIS SOM toolbox 2.0 2005
7. Cuppens F, Miege A. Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE symposium on security and privacy; 2002, p. 202.
8. Dain O, Cunningham RK. Fusing a heterogeneous alert stream into scenarios. In: Proceedings of the 2001 ACM workshop on data mining for security application, Philadelphia, PA; 2001, p. 113.
9. Debar H, Wespi A. Aggregation and correlation of intrusion-detection alerts. In: Proceedings of the fourth international symposium on recent advances in intrusion detection, Davis, CA, USA; 2001, p. 85103.
10. A. Flexer Limitations of self organizing map for vector quantization and multidimensional scaling M.C. Mozer, Advances in neural information processing systems vol. 9 1997 MIT Press/Bradford Books 445 451
11. Julisch K, Dacier M. Mining intrusion detection alarms for actionable knowledge. In: Proceedings of the eighth ACM SIGKDD international conference on knowledge discovery and data mining; 2002, p. 266375.
12. Julisch K. Mining alarm clusters to Improve alarm handling efficiency. In: Proceedings of the 17th annual conference on computer security applications; 2001, p. 1221.
13. T. Kohonen Self-organizing maps 1st ed. 1995 Springer Germany 3540620176
14. Labib K, Vemuri R. NSOM: a real-time network-based intrusion detection system using self-organizing maps. In: Networks and security; 2002.
15. K.H. Law, and L.F. Kwok IDS false alarm filtering using KNN classifier Fifth international workshop on information security applications, WISA, Jeju Island, South Korea Lecture notes in com2puter science vol. 3325 2004
16. J.B. MacQueen Some methods for classification and analysis of Multivariate Observations Proceedings of fifth Berkeley symposium on mathematical statistic and probability vol. 1 1967 University of California Press Berkeley 281 297
17. Ning P, Cui Y, Reeves DS. Constructing attack scenarios through correlation of intrusion alerts. In: Proceedings of the ninth ACM conference on computer and communications security Washington, D.C.; 2002, p. 24554.
18. G. Piatetsky-Shapiro Discovery, analysis, and presentation of strong rules G. Piatetsky-Shapiro, W.J. Frawley, Knowledge discovery in databases 1991 AAAI/MIT Press Cambridge, MA
19. J.R. Quinlan C4.5: programs for and neural networks, machine learning 1st ed. 1993 Morgan Kaufman Publishers United State of America 1558602380
20. M.S. Shin, E.H. Kim, and K.H. Ryu False alarm classification model for network-based intrusion detection system, intelligence data engineering and automated learning Lecture notes in computer science vol. 3177/2004 2004 259265
21. R. Smith The web bug FAQ 1999
22. Snort: WEB-IIS view source via translate header 2007
23. Symantec: symantec global internet security threat report: trends for 2008 vol. XIV April 2009 http://eval.symantec.com/mktginfo/enterprise/white- papers/b-whitepaper-internet-security-threat-report-xiv-04-2009.en-us.pdf
24. G.C. Tjhai, M. Papadaki, S.M. Furnell, and N.L. Clarke The problem of false alarms: evaluation with Snort and DARPA 1999 dataset Trust, privacy and security in digital business Lecture notes in computer science vol. 5185/2008 2008 139 150
25. G.C. Tjhai, M. Papadaki, S.M. Furnell, and N.L. Clarke Investigating the problem of IDS false alarms: an experimental study using Snort Sushil Jajodia, Pierangela Samarati, Stelvio Cimato, Proceedings of the IFIP TC 11 23rd international information security conference IFIP international federation for information processing vol. 278 2008 Springer Boston 253 267
26. Valdes A, Skinner K. Probabilistic alert correlation. In: Proceedings of the fourth international symposium on recent advances in intrusion detection, Davis, CA, USA; 2001, p. 5468.
27. F. Van der Heijden, R. Duin, D. Ridder, and D.M.J. Tax Classification, parameter estimation and state estimation 1st ed. 2004 Wiley United State of America 978-0-470-09013-8
28. WebDAV overview 2001
29. Weijters T, Van Den Herik HJ, Van den Bosch A, Postma E. Avoiding overfitting with BP-SOM. In: Proceedings of the fifteenth international joint conference on artificial intelligence; 1997.
30. S. Zanero Analyzing TCP traffic patterns using self organizing maps Proceedings 13th international conference on image analysis and processing Lecture notes in computer science vol. 3617/2005 2005 83 90
31. B. Zhu, and A. Ghorbani Alert correlation for extracting attack strategies International Journal of Network Security 3 2 2006 244 258