Abstract
AbstractThe tremendous numbers of alerts provided by intrusion detection systems have made the alert correlation a vital issue. Despite of the considerable number of proposed methods, the online alert correlation is still an open issue. In this paper we proposed an online model for alert correlation. Our model consists of two modules: (1) the online fuzzy clustering module which clusters alerts into fuzzy events based on their similarity and historical relevance; (2) the fuzzy inter event pattern mining which provides the first module with the historical relevance of alerts by mining frequent fuzzy patterns among them. Using these two modules, our approach is as fast as similarity based approaches suitable for online alert correlation while it is able to extract complex attack scenarios like offline time consuming data mining based approaches. Furthermore, observing the frequent events makes our approach capable of detecting scenarios including wrapping tricks which tries to fake the source or destination IPs. The experimental results with the well‐known dataset DARPA2000 and the ISCX UNB intrusion detection evaluation dataset proved mentioned claims. Copyright © 2016 John Wiley & Sons, Ltd.
Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
