Authors:
Kalu Gamage Kavindu Induwara Kumarasinghe
1
;
Ilangan Pakshage Madhawi Pathum Kumarsiri
1
;
Harsha Pussewalage
2
;
Kapuruka Abarana Gedara Thihara Vilochana Kumarasinghe
1
;
Kushan Sudheera Kalupahana Liyanage
1
;
Yahani Pinsara Manawadu
1
and
Haran Mamankaran
3
Affiliations:
1
University of Ruhuna, Sri Lanka
;
2
University of Agder, Norway
;
3
Sysco Labs, Sri Lanka
Keyword(s):
Clustering, Cyber Security, Data Mining, Intrusion Detection System, Unsupervised Learning.
Abstract:
Network Intrusion Detection Systems (IDS) have evolved significantly over the past two decades to address the growing complexity of network infrastructures and the increasing volume of cyber threats. However, traditional IDS approaches either rely on predefined signatures, which fail to detect zero-day attacks, or use anomaly detection models that suffer from high false alarm rates, overwhelming security analysts with excessive alerts. This paper proposes a data mining and adaptive clustering-based unsupervised approach to efficiently process IDS-generated network alerts, reducing false positives and enhancing threat detection. Relevant alert features are extracted, and advanced data mining techniques are applied to identify frequent patterns, reducing false alerts. Clustering similar patterns further groups alerts from related attacks, thereby reducing the workload of security analysts. This allows analysts to gain a high-level understanding of intrusions without manually reviewing
vast numbers of alerts. The approach furthur enhances intrusion detection accuracy and provides actionable insights through alert correlation. The experimental results demonstrate significant improvements in detecting various cyber threats, including DDoS, Botnets, Port-scans, and more.
(More)