Mining alarm clusters to improve alarm handling efficiency

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2001-January, Issue , 2001, Pages 12-21

  Julisch, Klaus ^a  

^a IBM RESEARCH ZURICH   (Switzerland)

Author keywords

Approximation algorithms; Clustering algorithms; Humans; Intrusion detection; Laboratories; Monitoring; Network address translation; Pattern matching; TCPIP; Telecommunication traffic

Indexed keywords

ALARM SYSTEMS; ALGORITHMS; APPROXIMATION ALGORITHMS; INTRUSION DETECTION; LABORATORIES; MERCURY (METAL); MONITORING; PATTERN MATCHING; RESEARCH LABORATORIES; SECURITY OF DATA; SECURITY SYSTEMS; TELECOMMUNICATION TRAFFIC;

ALARM CLUSTERING; ALARM HANDLING; HUMAN OPERATOR; HUMANS; INTRUSION DETECTION SYSTEMS; NETWORK ADDRESS TRANSLATIONS; OPERATIONAL DATA; TCPIP;

CLUSTERING ALGORITHMS;

EID: 84949215209     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2001.991517     Document Type: Conference Paper

References (33)

1. R. Agrawal et al. Automatic Subspace Clustering of High Dimensional Data for Data Mining Applications. In ACM SIGMOD Int'l Conf. on Management of Data, pages 94-105, 1998
2. A. Ben-Dor, R. Shamir, and Z. Yakhini. Clustering Gene Expression Patterns. Journal of Computational Biology, 6(3/4):281-297, 1999
3. J. Broderick-Editor. IBM outsourced solution, 1998. http://www.infoworld.com/cgi-bin/ displayTC.pl?/980504sb3-ibm.htm
4. CERT Advisory CA-1996-26: Denial-of-Service Attack via ping. http://www.cert.org
5. Cisco Systems, Inc. NetRanger Documentation. http: //www.cisco.com
6. M. Erlinger and S. Staniford-Chen. Intrusion Detection Exchange Format (idwg). http://www.ietf.org/ html.charters/idwg-charter.html
7. D. Fasulo. An Analysis of Recent Work on Clustering Algorithms, 1999. http://www.cs.washington.edu/ homes/dfasulo
8. V. Ganti, J. Gehrke, and R. Ramakrishnan. CACTUS-Clustering Categorical Data Using Summaries. In 5th ACM SIGKDD Int'l Conf. on Knowldege Discovery in Databases (SIGKDD), pages 73-83, 1999
9. D. Gibson, J. M. Kleinberg, and P. Raghavan. Clustering Categorical Data: An Approach Based on Dynamical Systems. VLDB Journal, 8(3):222-236, 2000
10. S. Guha, R. Rastogi, and K. Shim. ROCK: A Robust Clustering Algorithm for Categorical Attributes. Information Systems, 25(5):345-366, 2000
11. J. Han, Y. Cai, and N. Cercone. Knowledge Discovery in Databases: An Attribute-Oriented Approach. In 18th VLDB Conference, pages 547-559, 1992
12. J. Han, Y. Cai, and N. Cercone. Data-Driven Discovery of Quantitative Rules in Relational Databases. IEEE Transactions on Knowledge and Data Engineering, 5(1):29-40, 1993
13. J. Han and M. Kamber. Data Mining: Concepts and Techniques. Morgan Kaufmann Publisher, 2000
14. J. L. Hellerstein and S. Ma. Mining Event Data for Actionable Patterns. In The Computer Measurement Group, 2000
15. Internet Security Systems, Inc. RealSecure Signatures Reference Guide, 2001. http://documents.iss.net/ literature/RealSecure/RS-Signatures-6. 0.pdf
16. A. Jain and R. Dubes. Algorithms for Clustering Data. Prentice-Hall, 1988
17. K. Julisch. Dealing with False Positives in Intrusion Detection. In 3nd Workshop on Recent Advances in Intrusion Detection, 2000. http://www.raid-symposium.org/ raid2000/program.html
18. I. Katzela and M. Schwartz. Schemes for fault identification in communication networks. IEEE/ACM Transactions on Networking, 3(6):753-764, 1995
19. M. Klemettinen. A Knowledge Discovery Methodology for Telecommunication Network Alarm Data. PhD thesis, University of Helsinky (Finland), 1999
20. D. Koller and M. Sahami. Toward Optimal Feature Selection. In 13th Int'l Conf. on Machine Learning (ICML-96), pages 284-292, 1996
21. W. Lee. A Data Mining Framework for Constructing Features and Models for Intrusion Detection Systems. PhD thesis, Computer Science Department, Columbia University, NY, 1999
22. H. Liu and R. Setiono. A Probabilistic Approach to Feature Selection-A Filter Solution. In 13th Int'l Conf. on Machine Learning, pages 319-327. Morgan Kaufmann, 1996
23. C.-C. Lo and S.-H. Chen. Robust Event Correlation Scheme for Fault Identification in Communication Network. IEEE Global Telecommunications Conference (GLOBECOM), 6:3745-3750, 1998
24. S. Manganaris et al. A Data Mining Analysis of RTID Alarms. In 2nd Workshop on Recent Advances in Intrusion Detection, 1999. http://www.raid-symposium. org/raid99/index.html
25. A. Mounji. Languages and Tools for Rule-Based Distributed Intrusion Detection. PhD thesis, Facultes Universitaires Notre-Dame de la Paix Namur (Belgium), 1997
26. C. H. Papadimitriou. Computational Complexity. Addison-Wesley, 1994
27. V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, 31(23-24):2435-2463, 1999
28. I. Rigoutsos and A. Floratos. Combinatorial pattern discovery in biological sequences: The TEIRESIAS Algorithm. Bioinformatics, 14(1):55-67, 1998
29. S. Staniford, J. A. Hoagland, and J. M. McAlerney. Practical Automated Detection of Stealthy Portscans. In ACM Computer and Communications Security IDS Workshop, pages 1-7, 2000
30. A. S. Tanenbaum. Computer Networks. Prentice-Hall, 1996
31. A. Valdes. Probabilistic Alert Correlation. In 4th Workshop on Recent Advances in Intrusion Detection, 2001
32. Y. Yang and J. O. Pedersen. A Comparative Study on Feature Selection in Text Categorization. In 14th Int'l Conf. on Machine Learning, pages 412-420, 1997
33. S. Yemini et al. High speed and robust event correlation. IEEE Communications Magazine, 34(5):82-90, 1996