Alert aggregation algorithm based on genetic clustering algorithm

Abstract

An alert aggregation algorithm was proposed,in which alerts of Intrusion Detection System(IDS)based on genetic clustering algorithm were aggregated.To convert the dissimilarity between two alert attributes into the value range of [0.0,1.0],the dissimilarity of two alerts was represented by using a dissimilarity matrix;the more excellent clustering centers were chosen by the genetic algorithm,and the similar alerts would be clustered according to the dissimilarity matrix.Hierarchical aggregation method was adopted for every kind of alerts to aggregate according to the results of clustering.The experimental results show that the repeat alerts can be decreased effectively by this method.