A Sampling Method for Mining User´s Preference

Recent years, society relies heavily on the network infrastructure and information system. Protecting these assets from frequently network attacks needs to deploy some distributed security systems. However the amount of data produced by many distributed security tools can be overwhelming. So it´s very difficult and limited to get the most risky alert through manual process based on the huge network alerts with many attributes. The common method used to rank the alerts is scoring function, the higher the score, the more risky of the alert. Our motivation is that many times, user can not precisely specify the weights for the scoring function as their preference in order to get the preferable Ranking. In this paper, we propose a sampling method to mining user´s preference. Based on this preference, the most risky alerts can be easily ranked for emergency response. An extensive performance study using both synthetic and real datasets is reported to verify its effectiveness and efficiency.