A New System for Clustering and Classification of Intrusion Detection System Alerts Using Self-Organizing Maps

Intrusion Detection Systems (IDS) allow to protect systems used byorganizations against threats that emerges network connectivity by increasing.The main drawbacks of IDS are the number of alerts generated and failing. Byusing Self-Organizing Map (SOM), a system is proposed to be able to classifyIDS alerts and to reduce false positives alerts. Also some alert filtering andcluster merging algorithm are introduce to improve the accuracy of the proposedsystem. By the experimental results on DARPA KDD cup 98 the system is able tocluster and classify alerts and causes reducing false positive alerts considerably.