Referenced Items are not available for this document.
It is a well-known problem that intrusion detection systems overload their human operators by triggering thousands of alarms per day. As a matter of fact, IBM Research's Zurich Research Laboratory has been asked by one of our service divisions to help them deal with this problem. This paper presents the results of our research, validated thanks to a large set of operational data. We show that alarms should be managed by identifying and resolving their root causes. Alarm clustering is introduced as a method that supports the discovery of root causes. The general alarm clustering problem is proved to be NP-complete, an approximation algorithm is proposed, and experiments are presented.
Published in:
Computer Security Applications Conference, 2001. ACSAC 2001. Proceedings 17th Annual
Date of Conference: 10-14 Dec. 2001
- Page(s):
- 12 - 21
- Print ISBN:
- 0-7695-1405-7
- INSPEC Accession Number:
- 7190622
- Digital Object Identifier :
- 10.1109/ACSAC.2001.991517
- Product Type:
- Conference Publications
About IEEE Xplore | Contact | Help | Terms of Use | Nondiscrimination Policy | Site Map | Privacy & Opting Out of Cookies
A not-for-profit organization, IEEE is the world's largest professional association for the advancement of technology.
© Copyright 2013 IEEE - All rights reserved. Use of this web site signifies your agreement to the terms and conditions.
