A subjective distance for clustering security events

Intrusion detection systems overload their human operators by triggering thousands of alarms per day, most of which are false positives. A clustering method, put forward by Claus Julisch, is very effective in eliminating false positives and finding the root causes. However, according to the variance related to the operators´ knowledge and experience, a gap may exist between the nature of the event clusters and what the operators obtained from the resulting clusters. A subjective distance, different from the objective distance defined by Julisch, is proposed to fill the gap by controlling the clustering process with the subjective distance.