Necessary conditions for determining a robust time threshold in standard INFOSEC alert clustering algorithms

The standard INFOSEC alert clustering algorithms use a predetermined fixed time threshold for specifying the maximum duration over which new INFOSEC alerts can be added to existing alert clusters. Since these alert clusters are the basis of further alert correlation processing, an important question is can this time threshold be set robustly, in the sense that an optimal value can be found that is independent of the attackers´ actions. In this work the necessary conditions for such a robust threshold to be determined are derived. That these conditions cannot be assumed to hold for operational real world deployments of alert clustering systems in large scale networks is then discussed.