Research on Alarm Reduction of Intrusion Detection System Based on Clustering and Whale Optimization Algorithm
Source abstract
Abstract
With the frequent occurrence of network security events, the intrusion detection system will generate alarm and log records when monitoring the network environment in which a large number of log and alarm records are redundant, which brings great burden to the server storage and security personnel. How to reduce the redundant alarm records in network intrusion detection has always been the focus of researchers. In this paper, we propose a method using the whale optimization algorithm to deal with massive redundant alarms. Based on the alarm hierarchical clustering, we integrate the whale optimization algorithm into the process of generating alarm hierarchical clustering and optimizing the cluster center and put forward two versions of local hierarchical clustering and global hierarchical clustering, respectively. To verify the feasibility of the algorithm, we conducted experiments on the UNSW-NB15 data set; compared with the previous alarm clustering algorithms, the alarm clustering algorithm based on the whale optimization algorithm can generate higher quality clustering in a shorter time. The results show that the proposed algorithm can effectively reduce redundant alarms and reduce the load of IDS and staff.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China
References (49)
Show source-provided references
1. Sun, J., Gu, L., and Chen, K. (2020). An Efficient Alert Aggregation Method Based on Conditional Rough Entropy and Knowledge Granularity. Entropy, 22.10.3390/e22030324 ↗
2. A taxonomy of network threats and the effect of current datasets on intrusion detection systems10.1109/ACCESS.2020.3000179 ↗
3. A survey and taxonomy of the fuzzy signature-based Intrusion Detection Systems10.1016/j.asoc.2020.106301 ↗
4. Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues10.1016/j.knosys.2019.105124 ↗
5. KDD Cup 99 Data Sets: A Perspective on the Role of Data Sets in Network Intrusion Detection Research10.1109/MC.2018.2888764 ↗
6. Ingre, B., and Yadav, A. (2015, January 2–3). Performance analysis of NSL-KDD dataset using ANN. Proceedings of the 2015 International Conference on Signal Processing and Communication Engineering Systems, Guntur, India.10.1109/SPACES.2015.7058223 ↗
7. Detecting Distributed Denial of Service Attacks Using Data Mining Techniques
8. Moustafa, N., and Slay, J. (2015, January 10–12). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.10.1109/MilCIS.2015.7348942 ↗
9. Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22–24). A detailed analysis of the cicids2017 data set. Proceedings of the International Conference on Information Systems Security and Privacy, Funchal-Madeira, Portuga.10.1007/978-3-030-25109-3_9 ↗
10. Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., and Smuikys, P. (2020). LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection. Electronics, 9.10.3390/electronics9050800 ↗
11. Clustering mixed numerical and categorical data with missing values10.1016/j.ins.2021.04.076 ↗
12. Pattanodom, M., Iam-On, N., and Boongoen, T. (2016, January 21–23). Clustering data with the presence of missing values by ensemble approach. Proceedings of the 2016 Second Asian Conference on Defence Technology (acdt), Chiang Mai, Thailand.10.1109/ACDT.2016.7437660 ↗
13. Boluki, S., Dadaneh, S.Z., Qian, X., and Dougherty, E.R. (2019). Optimal clustering with missing values. BMC Bioinform., 20.10.1186/s12859-019-2832-3 ↗
14. Ahmed, T., Siraj, M.M., Zainal, A., and Mat Din, M. (2014, January 26–27). A taxonomy on intrusion alert aggregation techniques. Proceedings of the 2014 International Symposium on Biometrics and Security Technologies (ISBAST), Kuala Lumpur, Malaysia.10.1109/ISBAST.2014.7013129 ↗
15. Husák, M., Čermák, M., Laštovička, M., and Vykopal, J. (2017, January 8–12). Exchanging security events: Which and how many alerts can we aggregate?. Proceedings of the 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM), Lisbon, Portugal.10.23919/INM.2017.7987340 ↗
16. Reducing false alarms in intrusion detection systems—A survey
17. Alarm clustering analysis and ACO based multi-variable alarms thresholds optimization in chemical processes10.1016/j.psep.2017.09.020 ↗
18. Enhancing the Accuracy of Intrusion Detection Systems by Reducing the Rates of False Positives and False Negatives Through Multi-objective Optimization10.1007/s10922-018-9459-y ↗
19. An intrusion detection method for internet of things based on suppressed fuzzy clustering10.1186/s13638-018-1128-z ↗
20. An IDS alerts aggregation algorithm based on rough set theory10.1088/1757-899X/322/6/062009 ↗
21. Towards False Alarm Reduction Using Fuzzy If-Then Rules for Medical Cyber Physical Systems10.1109/ACCESS.2018.2794685 ↗
22. Hu, Q., Lv, S., Shi, Z., Sun, L., and Xiao, L. Defense against advanced persistent threats with expert system for internet of things. Proceedings of the International Conference on Wireless Algorithms, Systems, and Applications; Guilin, China, 19–21 June 2017.10.1007/978-3-319-60033-8_29 ↗
23. Zaeri-Amirani, M., Afghah, F., and Mousavi, S. (2018, January 18–21). A feature selection method based on shapley value to false alarm reduction in icus a genetic-algorithm approach. Proceedings of the 2018 40th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC), Honolulu, HI, USA.10.1109/EMBC.2018.8512266 ↗
24. Routing for Efficient Alarm Aggregation in Smart Grids: A Genetic Algorithm Approach10.1016/j.procs.2018.04.026 ↗
25. Preprocessing of Alarm Data for Data Mining10.1021/acs.iecr.8b05955 ↗
26. Intrusion detection system based on data mining techniques to reduce false alarm rate10.30684/etj.36.2B.3 ↗
27. A survey of swarm intelligence for dynamic optimization: Algorithms and applications10.1016/j.swevo.2016.12.005 ↗
28. The whale optimization algorithm10.1016/j.advengsoft.2016.01.008 ↗
29. A comprehensive survey: WOA and its applications10.1016/j.swevo.2019.03.004 ↗
30. Adaptive machine learning based alarm reduction via edge computing for distributed intrusion detection systems10.1002/cpe.5101 ↗
31. Toldinas, J., Venčkauskas, A., Damaševičius, R., Grigaliūnas, Š., Morkevičius, N., and Baranauskas, E. (2021). A Novel Approach for Network Intrusion Detection Using Multistage Deep Learning Image Recognition. Electronics, 10.10.3390/electronics10151854 ↗
32. Weiß, I., Kinghorst, J., Kröger, T., Pirehgalin, M.F., and Vogel-Heuser, B. (2018, January 18–20). Alarm flood analysis by hierarchical clustering of the probabilistic dependency between alarms. Proceedings of the 2018 IEEE 16th International Conference on Industrial Informatics (INDIN), Porto, Portugal.10.1109/INDIN.2018.8471973 ↗
33. Fahimipirehgalin, M., Weiss, I., and Vogel-Heuser, B. (2020, January 12–15). Causal inference in industrial alarm data by timely clustered alarms and transfer entropy. Proceedings of the 2020 European Control Conference (ECC), St. Petersburg, Russia.10.23919/ECC51009.2020.9143823 ↗
34. Alharbi, A., Alosaimi, W., Alyami, H., Rauf, H., and Damaševičius, R. (2021). Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things. Electronics, 10.10.3390/electronics10111341 ↗
35. Abu Khurma, R., Almomani, I., and Aljarah, I. (2021). IoT Botnet Detection Using Salp Swarm and Ant Lion Hybrid Optimization Model. Symmetry, 13.10.3390/sym13081377 ↗
36. Zhang, J., Yu, B., and Li, J. (2016, January 8–10). Research on IDS Alert Aggregation Based on Improved Quantum-behaved Particle Swarm Optimization. Proceedings of the Computer Science and Technology(CST2016), Shenzhen, China.10.1142/9789813146426_0034 ↗
37. Lin, H.C., Wang, P., Lin, W.H., Chao, K.M., and Yang, Z.Y. (2021). Identifying the Attack Sources of Botnets for a Renewable Energy Management System by Using a Revised Locust Swarm Optimisation Scheme. Symmetry, 13.10.3390/sym13071295 ↗
38. A Feature Selection Technique for Cloud IDS Using Ant Colony Optimization and Decision Tree10.1166/asl.2017.10045 ↗
39. Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing10.1186/s13638-016-0623-3 ↗
40. An Alert Aggregation Algorithm Based on K-means and Genetic Algorithm10.1088/1757-899X/435/1/012031 ↗
41. Bat algorithm: A novel approach for global engineering optimization10.1108/02644401211235834 ↗
42. Grey wolf optimizer10.1016/j.advengsoft.2013.12.007 ↗
43. A new meta-heuristic optimizer: Pathfinder algorithm10.1016/j.asoc.2019.03.012 ↗
44. Clustering intrusion detection alarms to support root cause analysis10.1145/950191.950192 ↗
45. Julisch, K. (2003). Using Root Cause Analysis to Handle Intrusion Detection Alarms. [Ph.D. Thesis, University of Dortmund].
46. Wang, J., Wang, H., and Zhao, G. (2006, January 25–28). A GA-based Solution to an NP-hard Problem of Clustering Security Events. Proceedings of the 2006 International Conference on Communications, Circuits and Systems, Guilin, China.10.1109/ICCCAS.2006.284911 ↗
47. Wang, J., Xia, Y., and Wang, H. (2007, January 11–13). Minining Intrusion Detection Alarms with an SA-based Clustering Approach. Proceedings of the 2007 International Conference on Communications, Circuits and Systems, Kokura, Japan.
48. Whale optimization approaches for wrapper feature selection10.1016/j.asoc.2017.11.006 ↗
49. Data mining in bioinformatics using Weka10.1093/bioinformatics/bth261 ↗