Network Security White Papers
Distinguishing False From True Alerts in Snort by Data Mining Patterns of Alerts
Overview The Snort network intrusion detection system is well known for triggering large numbers of false alerts. In addition, it usually only warns of a potential attack without stating what kind of attack it might be. This paper presents a clustering approach for handling Snort alerts more effectively. Central to this approach is the representation of alerts using the Intrusion Detection Message Exchange Format, which is written in XML. All the alerts for each network session are assembled into a single XML document, thereby representing a pattern of alerts. A novel XML distance measure is proposed to obtain the distance between two such XML documents. A classical clustering algorithm, implemented based on this distance measure, is then applied to group the alert patterns into clusters.
| Publisher | Florida State University | File Format | |
|---|---|---|---|
| Date Published | January 2006 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 1 out of 3 users found this white paper useful
White Paper RSS
Download
Register
