An intrusion detection system using correlation, prioritization and clustering techniques to mitigate false alerts

Intrusion detection system (IDS) is one of the network security tools which monitors the network traffic for suspicious activity and alerts the network administrator. In large networks, huge volumes of false alerts are generated by IDS which reduces the effectiveness of the system and increases the work of the network administrator. The false incoming alerts raised by IDS lower the defence of network. In this paper, post-correlation methods such as prioritization and clustering are used to analyse intrusion alerts. The proposed framework uses prioritization to classify important and unimportant alerts and clustering approaches by correlating the alerts. Scalable distance-based clustering (SDC) is applied to further reduce the false alerts efficiently.