A Clustering-Based Judgment Method of False Positive Alerts

Abstract

This paper proposes a clustering-based judgment method for false positive alerts generated by security devices. In the proposed method, firstly, alerts with the same attack source IP address over a certain period of time in the past are extracted. After the extraction, using the accumulated signature amount from extracted alerts, the alerts with si milar patterns are classified into several clusters using a method combining DBSCAN and K-means++. Then, the judgment of false positive alerts is done based on the number of alerts in each cluster. From a trial usage of the proposed method on two 7-day alert sets from two different networks, it was found that the recall rate was 100%, the precision rate was 34%, and the F-measure was 50%. The precision rate was improved by more than ten times compared to K-means++ alone, and about 2.4 times compared to DBSCAN alone.