Alert Clustering using Self-Organizing Maps and K-Means Algorithm

Abstract

Alert correlation is a system that receives alerts from heterogeneous Intrusion Detection Systems and reduces false alerts, detects high-level patterns of attacks, increases the meaning of occurred incidents, predicts the future states of attacks, and detects root cause of attacks. This paper presents self-organizing maps and the k-means machine learning algorithms to reduce the number of alerts by clustering them.