Patent ID: 7917393

Claim:
In an intrusion detection system that includes a plurality of sensors that generate alerts when attacks or anomalous incidents are detected, a method for organizing the alerts into alert classes, both the alerts and the alert classes having a plurality of features, the method comprising: (a) receiving a new alert; (b) identifying a set of similar features shared by the new alert and one or more existing alert classes; (c) updating, using a processor, a threshold similarity requirement for one or more of the similar features; (d) updating, using a processor, a similarity expectation for one or more of the similar features; (e) comparing, using a processor, the new alert with the one or more existing alert classes, using a similarity measure Sim(X,Y) that expresses a similarity between the new alert and a given one of the one or more existing alert classes, where SIM(X,Y) is defined as: Sim ⁡ ( X , Y ) = [ ∑ C ∈ X ⁢ ⁢ and ⁢ ⁢ C ∈ Y ⁢ P x ⁡ ( C ) × P Y ⁡ ( C ) ] 2 ( P X · P X ) ⁢ ( P Y · P Y ) where X is a set of features and probability values for the new alert, Y is a set of features and probability values for the given one of the one or more existing alert classes, P X (C) is probability of a category C in X, P Y (C) is a probability of the category C in Y, P X is a probability vector over one or more categories observed for X, and P Y is a probability vector over one or more categories observed for Y; and either: (f1) associating, using a processor, the new alert with a one of the one or more existing alert classes that the new alert most closely matches according to the similarity measure; or (f2) defining, using a processor, a new alert class that is associated with the new alert.