Mining alarm clusters to improve alarm handling efficiency

No abstract is available for this paper.

• Publication year

  2001

• Venue

  Seventeenth Annual Computer Security Applications Conference

• Publication date

  2001-12-10

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1109/ACSAC.2001.991517
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Computer networks

  2018cited by this paper
• Data Mining - Concepts and Techniques

  2002influential reference
• Practical automated detection of stealthy portscans

  2002cited by this paper
• Probabilistic Alert Correlation

  2001cited by this paper
• Clustering categorical data: an approach based on dynamical systems

  2000cited by this paper
• Mining Event Data for Actionable Patterns

  2000cited by this paper
• A Data Mining Analysis of RTID Alarms

  2000cited by this paper
• A framework for constructing features and models for intrusion detection systems

  2000cited by this paper
• Dealing with False Positives in Intrusion Detection

  2000cited by this paper
• Robust event correlation scheme for fault identification in communication networks

  1999cited by this paper
• A Knowledge Discovery Methodology for Telecommunication Network Alarm Databases

  1999cited by this paper
• An Analysis of Recent Work on Clustering Algorithms

  1999cited by this paper
• Clustering Gene Expression Patterns

  1999cited by this paper
• A Data Mining Framework for Constructing Features and Models for Intrusion Detection Systems

  1999cited by this paper
• ROCK: a robust clustering algorithm for categorical attributes

  1999cited by this paper
• CACTUS—clustering categorical data using summaries

  1999cited by this paper
• Bro: a system for detecting network intruders in real-time

  1998cited by this paper
• Automatic subspace clustering of high dimensional data for data mining applications

  1998cited by this paper
• Combinatorial pattern discovery in biological sequences: The TEIRESIAS algorithm [published erratum appears in Bioinformatics 1998;14(2): 229]

  1998cited by this paper
• Robust event correlation scheme for fault identification in communications network

  1998cited by this paper
• A Comparative Study on Feature Selection in Text Categorization

  1997cited by this paper
• A Probabilistic Approach to Feature Selection - A Filter Solution

  1996cited by this paper
• Toward Optimal Feature Selection

  1996cited by this paper
• High speed and robust event correlation

  1996cited by this paper
• Schemes for fault identification in communication networks

  1995cited by this paper
• Data-Driven Discovery of Quantitative Rules in Relational Databases

  1993cited by this paper
• Knowledge Discovery in Databases: An Attribute-Oriented Approach

  1992cited by this paper
• Algorithms for Clustering Data

  1988cited by this paper
• Schemes for Fault Identi cation in

  year unknowncited by this paper

• On the Application of Fundamental Clustering Methods to Large Scale Cyber Security Log Classification

  2025cites this paper
• Contrastive Learning for Correlating Network Incidents

  2025cites this paper
• Large Scale Cyber Security Log Classification Using Semi-Supervised Clustering

  2025cites this paper
• Alert correlation for intelligent threat detection and response

  2025cites this paper
• A systematic literature review on advanced persistent threat behaviors and its detection strategy

  2024cites this paper
• Analysis of Security Events in Industrial Networks Using Self-Organizing Maps by the Example of Log4j

  2023cites this paper
• An Examination of Big Data Analytics Frameworks for Targeted Cyber-Attack Detection

  2023cites this paper
• An Enhanced EWMA for Alert Reduction and Situation Awareness in Industrial Control Networks*

  2022cites this paper
• Detecting multi-stage attacks using sequence-to-sequence model

  2021cites this paper
• A Survey on Machine Learning based Intrusion Detection Systems Using Apache Spark

  2021cites this paper
• Big knowledge-based semantic correlation for detecting slow and low-level advanced persistent threats

  2021cites this paper
• FIXME: Enhance Software Reliability with Hybrid Approaches in Cloud

  2021cites this paper
• MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

  2020cites this paper
• A semantic-based correlation approach for detecting hybrid and low-level APTs

  2019cites this paper
• How to trick the Borg: threat models against manual and automated techniques for detecting network attacks

  2019cites this paper
• A Novel Split-Merge-Evolve k Clustering Algorithm

  2018cites this paper
• Extracting and Evaluating Similar and Unique Cyber Attack Strategies from Intrusion Alerts

  2018influential citation
• Enhancing the Accuracy of Intrusion Detection Systems by Reducing the Rates of False Positives and False Negatives Through Multi-objective Optimization

  2018cites this paper
• Cyber Anomaly Detection Using Graph-node Role-dynamics

  2018cites this paper
• False Alarm Reduction: A Profiling Mechanism and New Research Directions

  2018cites this paper
• A systematic survey on multi-step attack detection

  2018cites this paper
• A Complex Attacks Recognition Method in Wireless Intrusion Detection System

  2018cites this paper
• United States Patent Rajagopalan

  2017cites this paper
• Predictive Shutdown Systems for Nuclear Power Plants

  2017cites this paper
• Proposing A New Model to Improve Alert Detection in Intrusion Detection Systems

  2017cites this paper
• Association Mining Analysis of Alarm Root-Causes in Power System with Topological Constraints

  2017cites this paper
• Reducing false positives in intrusion detection systems using data-mining techniques utilizing support vector machines, decision trees, and naive Bayes for off-line analysis

  2016cites this paper
• Enhancing Performance of Intrusion Detection Systems using Data Fusion Techniques

  2016cites this paper
• A wireless intrusion Alerts Clustering Method for mobile internet

  2016cites this paper
• Reducing False Positive in Intrusion Detection System : A Survey

  2016cites this paper
• The Analysis of the APT Prelude by Big Data Analytics

  2016cites this paper
• False Positives Reduction in Intrusion Detection Systems Using Alert Correlation and Data mining Techniques

  2015cites this paper
• A realistic graph-based alert correlation system

  2015cites this paper
• False alarm minimization techniques in signature-based intrusion detection systems: A survey

  2014cites this paper
• A Survey on IDS Alerts Classification Techniques

  2014cites this paper
• Learning Time-based Rules for Prediction of Alarms from Telecom Alarm Data Using Ant Colony Optimization

  2014cites this paper
• Probabilistic Fault Management in Networked Systems

  2014cites this paper
• Diagnostic de systèmes complexes par comparaison de listes d’alarmes : application aux systèmes de contrôle du LHC

  2014cites this paper
• Design for Zombie PCs and APT Attack Detection based on traffic analysis

  2014cites this paper
• A taxonomy on intrusion alert aggregation techniques

  2014cites this paper
• Web driven alert verification

  2014cites this paper
• Alert Correlation Algorithms: A Survey and Taxonomy

  2013cites this paper
• False Alarm Reduction Using Adaptive Agent-Based Profiling

  2013cites this paper
• Creditability-based weighted voting for reducing false positives and negatives in intrusion detection

  2013cites this paper
• Collaborative Detection of Coordinated Port Scans

  2013cites this paper
• False Positives Reduction Techniques in Intrusion Detection Systems-A Review

  2013cites this paper
• The semantics of alarm definitions: enabling systematic reasoning about alarms

  2012cites this paper
• An Operational Framework for Alert Correlation using a Novel Clustering Approach

  2012influential citation
• Research of D-S Evidence Method in Network Attack Intention Recognition

  2012cites this paper
• Improved Support Vector Machine Wireless Network Security Detection Algorithm Model

  2012cites this paper
• Application of Nonlinear Combination Prediction Model for Network Traffic

  2012cites this paper
• An orchestration approach for unwanted Internet traffic identification

  2012cites this paper
• Alert correlation framework using a novel clustering approach

  2012cites this paper
• Application of Fuzzy AHP Method in the Effect Evaluation of Network Attack

  2012cites this paper
• On the Verification and Validation of Signature-Based, Network Intrusion Detection Systems

  2012cites this paper
• The Analysis of Event Correlation in Security Operations Center

  2011cites this paper
• A distributional attack scenario monitoring system based on dynamic peer-to-peer overlay hierarchy

  2011cites this paper
• Methods for Detecting Important Events and Knowledge from Data Security Logs

  2011cites this paper
• Application of Singular Spectrum Analysis to the Noise Reduction of Intrusion Detection Alarms

  2011cites this paper
• Detecting Abnormal Network Traffic in the Secure Event Management Systems

  2011cites this paper
• A New System for Clustering and Classification of Intrusion Detection System Alerts Using Self-Organizing Maps

  2011cites this paper
• Anomaly-based correlation of IDS alarms

  2011cites this paper
• Automatic attack scenario discovering based on a new alert correlation method

  2011cites this paper
• Time series analysis based models for network abnormal traffic detection

  2011cites this paper
• A hybrid model for correlating alerts of known and unknown attack scenarios and updating attack graphs

  2011cites this paper
• A complete operational architecture of alert correlation

  2011cites this paper
• The security operations center based on correlation analysis

  2011cites this paper
• Alert correlation in collaborative intelligent intrusion detection systems - A survey

  2011cites this paper
• Personal(ized) Health Monitoring, Personalization, and Personality

  2011cites this paper
• A Novel Data Mining-Based Method for Alert Reduction and Analysis

  2010cites this paper
• New data mining technique to enhance IDS alarms quality

  2010influential citation
• Log Analysis Towards an Automated Forensic Diagnosis System

  2010cites this paper
• A preliminary two-stage alarm correlation and filtering system using SOM neural network and K-means algorithm

  2010cites this paper
• A survey of coordinated attacks and collaborative intrusion detection

  2010cites this paper
• A new system to evaluate GA-based clustering algorithms in Intrusion Detection alert management system

  2010cites this paper
• A Cache Oblivious based GA Solution for Clustering Problem in IDS

  2010cites this paper
• Privacy-preserving alert correlation and report retrieval

  2010cites this paper
• A graph oriented approach for network forensic analysis

  2010cites this paper
• Toward Automated Intrusion Alert Analysis

  2010cites this paper
• Hierarchically Clustering IDS Alarms Using a GA with Vary-lengthed Chromosomes

  2010influential citation
• Network IDS alert classification with frequent itemset mining and data clustering

  2010cites this paper
• Log Analysis Towards an Automated Forensic Diagnosis System

  2010cites this paper
• A Lightweight Intrusion Alert Fusion System

  2010cites this paper
• Clustering approach for false alerts reducing in behavioral based intrusion detection systems

  2010cites this paper
• Alert Management and Correlation

  2010cites this paper
• Real-Time Network Intrusionprevention

  2010cites this paper
• Heuristics for improved enterprise intrusion detection

  2009influential citation
• Dynamic Alarm Correlation based on Cellular Learning Automata in Telecommunication Networks

  2009cites this paper
• Processing intrusion detection alert aggregates with time series modeling

  2009cites this paper
• Reducing the Overlap among Hierarchical Clusters with a GA-Based Approach

  2009cites this paper
• Malware Characterization through Alert Pattern Discovery

  2009cites this paper
• Reducing IDS False Positives Using Incremental Stream Clustering Algorithm

  2009cites this paper
• Vulnerabilities Analyzing Model for Alert Correlation in Distributed Environment

  2009cites this paper
• Intrusion detection alarms reduction using root cause analysis and clustering

  2009cites this paper
• Revisiting Anomaly-based Network Intrusion Detection Systems

  2009cites this paper
• Chasing a Definition of “Alarm”

  2009cites this paper
• Finding Corrupted Computers Using Imperfect Intrusion Prevention System Event Data

  2008cites this paper
• Détection d'intrusions paramétrée par la politique de sécurité grâce au contrôle collaboratif des flux d'informations au sein du système d'exploitation et des applications : mise en œuvre sous Linux pour les programmes Java

  2008cites this paper
• A Survey of Alert Fusion Techniques for Security Incident

  2008cites this paper
• Automatic multi-step attack pattern discovering

  2008cites this paper