An Alert Aggregation Algorithm Based on K-means and Genetic Algorithm

Abstract

The Intrusion Detection System often produces a large number of alerts, in which 90% are useless. This makes it difficult for security administrator to identify real attack alerts. Using clustering algorithm, such as K-means, DBSCAN, can efficiently cluster the similar alerts, thus greatly reducing the number of alerts that need to be processed. However, the original clustering algorithm has some shortcomings, for example, the K-means has great dependence on the initial value selection, and it is easy to fall into local optimum. Therefore, this paper proposed a new alert aggregation method based on the genetic algorithm and K-means algorithm. We use the Darpa99 dataset to test the performance of our algorithm. And the experimental results show that the algorithm can obtain good aggregation results.