Heterogeneous Multi-sensor IDS Alerts Aggregation using Semantic Analysis

One of the major limitations of current Intrusion Detection System (IDS) technology is alerts flooding which is a time consuming and resource intensive problem for intrusion analysts and organizations. Alerts flooding has been handled using alerts aggregation techniques. In general, the majority of IDS alerts aggregation techniques use alerts similarity to aggregate and summarize alerts. Because intrusion characteristics are expressed using symbolic attributes, measuring the similarity between IDS alerts is difficult. Previous techniques in the area of alerts aggregation mostly use perfect match or ad-hoc techniques to measure the similarity between alerts attributes. In this paper, we propose a new IDS alerts aggregation and reduction technique based on semantic similarity between intrusions. We define a new metric to measure semantic similarity between different intrusion instances. In addition we propose a new information loss metric to measure the quality of the alert aggregation process. Previous techniques only used alerts reduction rate to evaluate the alerts aggregation process. Alerts reduction rate is a volume metric and is not sufficient to evaluate the quality of the alert aggregation process. Experimental evaluation using existing IDS benchmark datasets shows that our proposed technique can more effectively aggregate IDS alerts and control alerts flooding compared to previous techniques in the area, while still maintaining relatively lower level of infor-