Critical analyses of alerts swamping and intrusion redundancy

Alerts swamping and intrusion redundancy are two critical problems of intrusion detection technology that often worsen the problems of classification, data reduction, false positives, intrusion correlation and reporting. Consequently, the validity and continuous usage of intrusion detectors are constantly threatened because the system administrators are always helpless while trying to thwart attacks on computer infrastructure. Hence, this paper presents critically investigations of alert swamping and redundancy and how we have lessened them using a simple clustering method. Extensive evaluations that we performed on several synthetic and realistic datasets have significantly reduced these problems and have equally demonstrated the variability of these problems in each dataset. Also substantiated was a method that could help the system administrators to thwart attacks.