Abstract: The tremendous amount of the security alerts due to the high-speed alert generation of high-speed networks make the management of intrusion detection computationally expensive. Evidently, the high-level rate of wrong alerts disproves the Intrusion Detection Systems (IDS) performances and decrease its capability to prevent cyber-attacks which lead to tedious alert analysis task. Thus, it is important to develop new tools to understand intrusion data and to represent them in a compact forms using, for example, an alert clustering process. This hot topic of research is studied here and an understandable taxonomy followed by a deep survey of main published works related to intrusion alert management is presented in this paper. The second part of this work exposes different useful steps for designing a unified IDS system on the basis of machine learning techniques which are considered one of the most powerful tools for solving certain problems related to alert management and outlier detection.

Wajdi Alhakami, “Alerts Clustering for Intrusion Detection Systems: Overview and Machine Learning Perspectives” International Journal of Advanced Computer Science and Applications(IJACSA), 10(5), 2019. http://dx.doi.org/10.14569/IJACSA.2019.0100574

@article{Alhakami2019,
title = {Alerts Clustering for Intrusion Detection Systems: Overview and Machine Learning Perspectives},
journal = {International Journal of Advanced Computer Science and Applications},
doi = {10.14569/IJACSA.2019.0100574},
url = {http://dx.doi.org/10.14569/IJACSA.2019.0100574},
year = {2019},
publisher = {The Science and Information Organization},
volume = {10},
number = {5},
author = {Wajdi Alhakami}
}