17th Annual Computer Security Applications Conference
December 10-14, 2001
New Orleans, Louisiana

Mining Alarm Clusters to Improve Alarm Handling Efficiency

Klaus Julisch
IBM Research

It is a well-known problem that intrusion detection systems overload their human operators by triggering thousands of alarms per day. As a matter of fact, we have been asked by one of our service divisions to help them deal with this problem. This paper presents the results of our research, validated thanks to a large set of operational data. We show that alarms should be managed by identifying and resolving their root causes. Alarm clustering is introduced as a method that supports the discovery of root causes. The general alarm clustering problem is proved to be NP-complete, an approximation algorithm is proposed, and experiments are presented.

Read Paper Read Paper (in PDF)