Datamining Based Stratified Intrusion Detection

The intrusion detection systems focus on low-level attacks, and only generate isolated alerts. They can’t find logical relations among alerts. In addition, IDS’s accuracy is low; a lot of alerts are false alerts. So it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. To solve this problem different intrusion scenario detection methods are proposed. In this paper a data mining based clustering method is used to find the attack scenarios. Usually an attack consists of many steps in which corresponding alerts are generated, so we call each step is an attack scenario. In each step an attacker will perform a task to get certain target. The alerts generated in each step can be used as the feature of corresponding clustering approach.