Clustering approach for false alerts reducing in behavioral based intrusion detection systems

Behavioral intrusion detection systems are known by their high false alerts rates. In this paper, we propose to combine a behavioral intrusion detection approach with a clustering approach in order to obtain a set of clusters with different false alerts rates. The order of these clusters with respect to their false alerts rates will be considered as an alerts prioritization. Hence, new alerts will be classified to the closest cluster and processed according to their cluster priority. Experimental results, using a simulated IDS, show that our approach is able to reduce the false alerts rate produced by behavioral intrusion detection systems.