A GA-based Solution to an NP-hard Problem of Clustering Security Events

摘要: The clustering approach forwarded by Klaus Julisch is considerably effectual in eliminating false positives and finding root causes among huge amount of security events. But the problem was proved to be unfortunately an NP-hard one. In this paper, a GA-based algorithm forwarded, which much more effective than original approximation Julisch. coding scheme genetic operations including selection, crossover, mutation are discussed detail. To validate quality newly-forwarded approach, tree-version apriori given, quite time-consuming but able produce absolutely accurate solution used for comparison feasible period time. results show that valid efficient can find optimal clusters very similar ones.