A SOM and Bayesian Network Architecture for Alert Filtering in Network Intrusion Detection Systems

With the ever growing deployment of networks and the Internet, the importance of network security has increased. Recently, however, systems that detect intrusions, which are important in security countermeasures, have been unable to provide proper analysis or an effective defense mechanism. Instead, they have overwhelmed human operators with a large volume of intrusion detection alerts. This paper presents a new approach for handling intrusion detection alarms more efficiently. We propose here an architecture for automated alarm filtering based on classical method of clustering (self-organizing maps) coupled with probabilistic graphical model (Bayesian belief networks) for determining if the network is really attacked