Search Paper
  • Home
  • Login
  • Categories
  • Post URL
  • Academic Resources
  • Contact Us

 

Reducing the Cognitive Load on Analysts through Hamming Distance Based Alert Aggregation

google+
Views: 55                 

Author :  Peter Mell

Affiliation :  National Institute of Standards and Technology

Country :  USA

Category :  Networks & Communications

Volume, Issue, Month, Year :  6, 5, September, 2014

Abstract :


Previous work introduced the idea of grouping alerts at a Hamming distance of 1 to achieve lossless alert aggregation; such aggregated meta-alerts were shown to increase alert interpretability. However, a mean of 84023 daily Snort alerts were reduced to a still formidable 14099 meta-alerts. In this work, we address this limitation by investigating several approaches that all contribute towards reducing the burden on the analyst and providing timely analysis. We explore minimizing the number of both alerts and data elements by aggregating at Hamming distances greater than 1. We show how increasing bin sizes can improve aggregation rates. And we provide a new aggregation algorithm that operates up to an order of magnitude faster at Hamming distance 1. Lastly, we demonstrate the broad applicability of this approach through empirical analysis of Windows security alerts, Snort alerts, netflow records, and DNS logs. The result is a reduction in the cognitive load on analysts by minimizing the overall number of alerts and the number of data elements that need to be reviewed in order for an analyst to evaluate the set of original alerts.

Keyword :  Alert aggregation, Cognitive load, Hamming Distance, Hypergraphs, Security logs

URL :  https://airccse.org/journal/nsa/6514nsa03.pdf

User Name : Brendon Clarke
Posted 23-11-2022 on 15:31:22 AEDT



Related Research Work

  • Ransomware Attack Detection Based On Pertinent System Calls Using Machine Learning Techniques
  • Machine Learning Based Ensemble Classifier For Android Malware Detection
  • Intrusion Detection System (ids) Development Using Tree-based Machine Learning Algorithms
  • Investigation Of Ant Colony Optimization Algorithm For Efficient Energy Utilization In Wireless Sensor Network

About Us | Post Cfp | Share URL Main | Share URL category | Post URL
All Rights Reserved @ Call for Papers - Conference & Journals