Alerts Clustering for Intrusion Detection Systems: Overview and Machine Learning Perspectives

The tremendous amount of the security alerts due to the high-speed alert generation of high-speed networks make the management of intrusion detection computationally expensive. Evidently, the high-level rate of wrong alerts disproves the Intrusion Detection Systems (IDS) performances and decrease its capability to prevent cyber-attacks which lead to tedious alert analysis task. Thus, it is important to develop new tools to understand intrusion data and to represent them in a compact forms using, for example, an alert clustering process. This hot topic of research is studied here and an understandable taxonomy followed by a deep survey of main published works related to intrusion alert management is presented in this paper. The second part of this work exposes different useful steps for designing a unified IDS system on the basis of machine learning techniques which are considered one of the most powerful tools for solving certain problems related to alert management and outlier detection.

@article{Alhakami2019,
  title     = {Alerts Clustering for Intrusion Detection Systems: Overview and Machine Learning Perspectives},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {10},
  number    = {5},
  year      = {2019},
  publisher = {The Science and Information Organization},
  author    = {Wajdi Alhakami},
  doi       = {10.14569/IJACSA.2019.0100574},
  url       = {https://doi.org/10.14569/IJACSA.2019.0100574}
}