Alarm data fusion method based on improved spectral clustering

Abstract

The invention relates to the field of data processing, and discloses an alarm data fusion method based on improved spectral clustering. The method comprises the following steps: preprocessing alarm data; grouping the alarm data according to attack types; calculating the similarity between every two alarms for the alarm data in each group by using an attribute similarity measurement method, and constructing a similarity matrix; clustering the alarm data by using a spectral clustering algorithm based on the similarity matrix to form clusters; performing threshold judgment on the alarms in the same cluster: if the threshold is reached, fusing the alarm data in the same cluster, and then inputting the fused data into a fused data set; if the threshold value is not reached, directly inputting the data into a fusion data set; and combining the fusion data sets of all clusters into a simplified alarm data set and outputting the simplified alarm data set. According to the method, better clustering fusion can be realized under the condition that the relation between alarms is not damaged, the information loss is reduced, and the false alarm rate of the alarm data can be reduced while the fusion rate is improved.

Description

technical field [0001] The invention relates to the field of data processing, in particular to an alarm data fusion method based on improved spectrum clustering. Background technique [0002] Hackers or malicious attackers invade the network through various methods, causing the network environment to face a large number of targeted, hidden and penetrating potential threats, and network security is facing severe challenges. Intrusion Detection System (Intrusion Detection System, IDS) is used as a security defense system to detect whether there are intrusions in the network environment, and generate corresponding alarm data for various intrusions, so that security managers can take corresponding defense measures. A large number of redundant and erroneous alarms will be generated in the application, making it difficult for managers to find key alarm information, and thus unable to grasp the network security situation. Therefore, some researchers have proposed alarm data fusion...

AI Technical Summary

Problems solved by technology

[0003] In the process of alarm fusion, most methods do not pay attention to the relationship between alarm data and alarm attributes, and excessively simplify the alarm, which will cause the loss of key information, which is not conducive to further analysis of the alarm; the existing fusion methods have already Achieve a certain alarm fusion rate, but the false alarm rate is still high

Images