Analyzing intrusion alerts based on kernel neural-gas clustering

The unsupervised kernel neural-gas clustering method is applied to analyze intrusion alerts. The kernel neural-gas clustering method is improved for its high runtime, so the process of learning speeds up while its astringency is not affected. The improved kernel neural-gas clustering method was used to cluster the true alert data, and the frequency distributing figures of each neural as best matching unit are obtained. Based on these figures, the discriminant rules are gained to distinguish false positive alerts from true alerts. The experimental data is the alerts produced by Snort, a kind of network intrusion detection system, monitoring the attack and normal data in experimental environment. The testing results confirm the good performance of the proposed method: false positive alerts are reduced by 81% with sliding window of 10, at the cost of false negative alerts increased by 6%.