Using fuzzy clustering to reconstruct alert correlation graph of intrusion detection

Abstract

Causal correlation method was one of the most representative methods for instruction detection alert correla-tion. In some conditions, the correlation graph would be split because of loss of causal information. In order to solve the problem, an algorithm was proposed to reconstruct attack scenario using fuzzy clustering. A new similarity membership function based on the attribute hierarchy tree was defined in the process of clustering. Furthermore, the evaluation method and indexes were put forward to describe the ability of reconstructing attack scenario. The experimental results indicate that this algorithm is valid to combine the split correlation graph and reconstruct attack scenario.

Keywords

• alert correlation;attack scenario reconstruction;fuzzy clustering;similarity membership function