A data mining analysis of RTID alarms

被引：86

作者：

Manganaris, S ^{[1
]}

Christensen, M ^{[1
]}

Zerkle, D ^{[1
]}

Hermiz, K ^{[1
]}

机构：

[1] IBM Corp, Res Triangle Pk, NC 27713 USA

来源：

COMPUTER NETWORKS | 2000年 / 34卷 / 04期

关键词：

intrusion detection; data mining; context-sensitive anomaly detection; adaptive alarm filtering; sensor profiling;

D O I：

10.1016/S1389-1286(00)00138-9

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

IBM's emergency response service provides real-time intrusion detection (RTID) services through the Internet for a variety of clients. As the number of clients increases, the volume of alerts generated by the RTID sensors becomes intractable. This problem is aggravated by the fact that some sensors may generate hundreds or even thousands of innocent alerts per day. With an eye towards managing these alerts more effectively, IBM's data mining services group analyzed a database of RTID reports. The first objective was an approach for characterizing the "normal" stream of alerts from a sensor. Using such models tuned to individual sensors, we then developed a methodology for detecting anomalies. In contrast to many popular approaches, the decision to filter an alarm out or not takes into consideration the context in which it occurred and the historical behavior of the sensor it came from. Our second objective was to identify all the different profiles of our clients. Based on their history of alerts, we discovered several different types of clients, with different alert behaviors and thus different monitoring needs. We present the issues encountered, solutions, and findings, and discuss how our results may be used in large-scale RTID operations. (C) 2000 Elsevier Science B.V. All rights reserved.

引用

页码：571 / 577

页数：7

共 15 条

[1]

Agrawal R., 1993, SIGMOD Record, V22, P207, DOI 10.1145/170036.170072

[2]

Agrawal R., 1996, Advances in Knowledge Discovery and Data Mining, P307

[3]

[Anonymous], 1995, P 11 INT C DAT ENG T

[4]

Berry MichaelJ., 1997, DATA MINING TECHNIQU

[5]

Bigus J.P., 1996, DATA MINING NEURAL N

[6]

*CISC SYST INC, 1999, NETR US GUID

[7]

FAYYAD UM, 1996, ADV KNOWLEDGE DISCOV, pCH1

[8]

*IBM, 1996, INT MIN DAT US GUID

[9]

Lee W, 1998, PROCEEDINGS OF THE SEVENTH USENIX SECURITY SYMPOSIUM, P79

[10]

MANNILA H, 1995, P 1 INT C KNOWL DISC

← 1 2 →