基于混沌粒子群的IDS告警聚类算法

doi:10.3969/j.issn.1000-436x.2013.03.013

Abstract

Abstract:

In order to improve the quality of alerts in intrusion detection system (IDS) and reduce the large number of redundant alarms, an IDS alerts clustering algorithm based on chaotic particle swarm optimization was proposed.It made the motion of particles with characteristics of chaos,so as to make particles move between the state of chaos and stable, and gradually close to the optimal value. The CPSO algorithm could overcome the problem of premature and local opti-mization, and take the center of cluster to find the global optimal solution. The analysis and experiment show that the al-gorithm can significantly reduce the number of alerts improve its quality, and has a high detection rate and low false detection rate.

Key words: intrusion detection system, alert clustering, chaos, particle swarm opti ization

Xiao-bo XU,Qin-qin JIANG,Kang-feng ZHENG,Bin WU,Yi-xian YANG. IDS alert clustering algorithm based on chaotic particle swarm optimization[J]. Journal on Communications, 2013, 34(3): 105-110.

Figures/Tables 2

References 12

[1]	VAARANDIR . Real-time classification of IDS alerts with data min-ing techniques[A]. MILCOM 2009[C]. Boston, Massachusetts: IEEE Press, 2009. 1-7.
[2]	AI-MANIRYS O , ZHANGH L , ABBASA R . IDS alarms reduction using data mining[A]. WCCI 2008[C]. Hong Kong, China: IEEE Press, 2008. 3564-3570.
[3]	PIETRASZEKT . Using adaptive alert classification to reduce false positives in intrusion detection[A]. RAID 2004[C]. Sophia Antipolis, France: Springer-Verlag. 2004. 102-124.
[4]	VIINIKKAJ , DEBARH , ANSSIL , et al. Processing intrusion detec-tion alert aggregates with time series modeling[J]. Information Fusion Journal, 2009,10(4): 312-324.
[5]	VAARANDIR , PODINSK . Network IDS alert classification with frequent item-set mining and data clustering[A]. CNSM 2010[C]. Niagara Falls, Canada, IEEE Press, 2010. 451-456.
[6]	NJOGUH W , LUOJ W . Using alert cluster to reduce IDS alerts[A]. ICCSIT 2010[C]. Chengdu, China, IEEE Press, 2010. 467-471.
[7]	FEIA , DONGX L . Hierarchically clustering IDS alarms using a GA with vary-lengthed chromosomes[A]. ISIP 2010[C]. China: IEEE Press, 2010. 172-177.
[8]	LIY Z , YANGG , XUJ , et al. Anomaly detection for clustering algo-rithm based on particle swarm optimization[J]. Journal of Jiangsu University of Science and Technology(Natural Science Edition), 2009,23(1): 51-55.
[9]	WENZ W , LIR J . Fuzzy C-means clustering algorithm based on improved PSO[J]. Application Research of Computers, 2010,27(7): 2520-2522.
[10]	XUX B , ZHENGK F , LID , et al. A new chaos-particle swarm opti-mization algorithm[J]. Journal on Communications, 2012,33(1): 24-30.
[11]	LIL X , YANGY X , PENGH P , et al. An optimization method in-spired by chaotic ant behavior[J]. International Journal of Bifurcation and Chaos, 2006,16: 2351-2364.
[12]	SOLER V , MIRAMONTESO , GOODWINB C . Oscillations and chaos in ant societies[J]. Journal of Theoretical Biology, 1993,161(3): 343-357.

Metrics

Recommended 0

No Suggested Reading articles found!

聚类数 K	PSO-KM聚类算法		本文CPSO-KM聚类算法
聚类数 K	检测率	误警率	检测率	误警率
20	73.7	0.91	75.4	0.82
30	86.7	1.36	90.3	1.13
40	85.3	2.47	88.9	1.87
50	76.4	2.58	81.6	1.94
60	69.8	2.12	75.3	1.53
70	69.7	1.78	7.6 5	1.08
80	69.7	1.78	74.5	1.05
平均	74.43	1.86	80.35	1.35

[1]	Hua YANG, Yu WANG, Siyuan XU, Guoping JIANG. Time hopping short reference carrier index differential chaos shift keying communication scheme [J]. Journal on Communications, 2022, 43(3): 113-123.
[2]	Youliang TIAN,Yulong WU,Qiuxian LI. Optimum response scheme of intrusion detection based on information theory [J]. Journal on Communications, 2020, 41(7): 121-130.
[3]	Lilin YI,Junxiang KE. Research progress of chaotic secure optical communication [J]. Journal on Communications, 2020, 41(3): 168-181.
[4]	Wei SUN,Peng ZHANG,Yongquan HE,Lichao XING. Attack detection method based on spatiotemporal event correlation in intranet environment [J]. Journal on Communications, 2020, 41(1): 33-41.
[5]	Linfang LIU,Guosheng RUI,Yang ZHANG,Qianlong WU. Research on the chaotic secure communication of the phase-space symmetric Lorenz oscillator group [J]. Journal on Communications, 2019, 40(5): 32-38.
[6]	Lishuang GONG,Erlin HOU,Haifang LIU,Kaikai LI,Yuncai WANG. Physical random analysis of Boolean chaos [J]. Journal on Communications, 2019, 40(3): 190-195.
[7]	Qiqi ZHANG,Jianguo ZHANG,Pu LI,Yanqiang GUO,Yuncai WANG. Boolean-chaos-based physical random number generator [J]. Journal on Communications, 2019, 40(1): 201-206.
[8]	He TIAN,Hai ZHAO,Jinfa WANG,Chuan LIN. Timing evolution and prediction of Internet transmission behavior [J]. Journal on Communications, 2018, 39(6): 116-126.
[9]	Guang-ming SUN,Jin-jie HUANG,Qiao LIU. Research on the chaotic group secret communication of the distributed ,large-scale and multi-signal system [J]. Journal on Communications, 2017, 38(3): 124-132.
[10]	Ying WANG,Xiao-zhong ZHANG,Juan ZENG,Yong-ming WANG. Secure OFDM transmission scheme based on two-stage chaos mapping [J]. Journal on Communications, 2016, 37(7): 132-139.
[11]	Zhong-da TIAN,Shu-jiang LI,Yan-hong WANG,Xiang-dong WANG. Network traffic multi-step prediction based on chaos theory and improved echo state network [J]. Journal on Communications, 2016, 37(3): 55-70.
[12]	Guang-ming SUN,Jin-jie HUANG. Study on chaos phase space synchronous rotation and distinguish switching security communication [J]. Journal on Communications, 2016, 37(10): 99-107.
[13]	Hua YANG,Guo-ping JIANG,Jun-yi DUAN. High efficiency differential chaos shift keying modulation scheme without intra-signal interference [J]. Journal on Communications, 2015, 36(6): 88-93.
[14]	HOUWei Z,INGBo J,UANGYi-feng H,IAOXiao-xuan J,UJia-xing H,IANGWei L. CS-based data collection method for airborne clustering WSN [J]. Journal on Communications, 2015, 36(5): 130-139.
[15]	. Improved PSO algorithm based on swarm prematurely degree and nonlinear periodic oscillating strategy [J]. Journal on Communications, 2014, 35(2): 22-189.

IDS alert clustering algorithm based on chaotic particle swarm optimization

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 2

References 12

Related Articles 15

Metrics

Recommended 0