Dealing with Security Alert Flooding: Using Machine Learning for Domain-independent Alert Aggregation

Intrusion Detection Systems (IDS) secure all kinds of IT infrastructures through automatic detection malicious activities. Unfortunately, they are known to produce large numbers alerts that often become overwhelming for manual analysis. Therefore, aggregation methods have been developed filtering, grouping, and correlating alerts. However, existing techniques either rely on manually defined attack scenarios or require specific alert formats, such as IDMEF include IP addresses. This makes the application infeasible from host-based anomaly-based IDSs frequently lack network-related data. In this paper, we therefore present a domain-independent technique. We introduce similarity measures merging strategies arbitrary semi-structured groups. Based these metrics propose an incremental procedure generation abstract patterns enable continuous classification incoming Evaluations show our approach is capable reducing number groups human review by around \( 80\% \) assigning classifiers with true positive rates false lower than 5\% .