Cyberattack triage using incremental clustering for intrusion detection systems

摘要: Intrusion detection systems (IDSs) are devices or software applications that monitor networks for malicious activities and signals alerts/alarms when such activity is discovered. However, an IDS may generate many false alerts which affect its accuracy. In this paper, we develop a cyberattack triage algorithm to detect these (so-called outliers). The proposed designed using the clustering, optimization distance-based approaches. An optimization-based incremental clustering find clusters of different types cyberattacks. Using special procedure, set divided into two subsets: normal stable clusters. Then, outliers found among average distance between centroids evaluated well-known data sets—Knowledge Discovery Data mining Cup 1999 UNSW-NB15—and compared with some other existing algorithms. Results show has high accuracy negative rate very low.