Concurrent reduction of false positives and redundant alerts

Improving the results of intrusion detection systems

“…Experiments on various data-sets show that false positives are included in specific clusters and that it is then easy to discard them. This work has been extended in [26], whereby apart from false positives, redundant alerts are also filtered out through clustering procedures.…”