关键词: 网络安全 相似性评估 聚类 关联分析

Abstract:

Aiming at the problem that there are generally a great deal of redundant alerts in network security systems, this paper proposes a new transaction model which clusters the alerts by means of similarity evaluation and a hierarchical mechanism to reduce the amount of alerts efficiently. In addition, this model mines the potential correlation of alerts and produces new rules via association analysis, which will be helpful in recognizing new attack patte rns and improving the efficiency of clustering.

Key words: （network security, similarity evaluation, clustering, association analysis）