document: Mining intrusion detection alarms for actionable knowledge In response to attacks against enterprise networks , administrators increasingly deploy intrusion detection systems . These systems monitor hosts , networks , and other resources for signs of security violations . The use of intrusion detection has given rise to another difficult problem , namely the handling of a generally large number of alarms . In this paper , we mine historical alarms to learn how future alarms can be handled more efficiently . First , we investigate episode rules with respect to their suitability in this approach . We report the difficulties encountered and the unexpected insights gained . In addition , we introduce a new conceptual clustering technique , and use it in extensive experiments with real-world data to show that intrusion detection alarms can be handled efficiently by using previously mined knowledge .
doc_bio_tags: O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O