An Efficient Alert Aggregation Method Based on Conditional Rough Entropy and Knowledge Granularity

With the emergence of network security issues, various security devices that generate a large number of logs and alerts are widely used. This paper proposes an alert aggregation scheme that is based on conditional rough entropy and knowledge granularity to solve the problem of repetitive and redundant alert information in network security devices. Firstly, we use conditional rough entropy and knowledge granularity to determine the attribute weights. This method can determine the different important attributes and their weights for different types of attacks. We can calculate the similarity value of two alerts by weighting based on the results of attribute weighting. Subsequently, the sliding time window method is used to aggregate the alerts whose similarity value is larger than a threshold, which is set to reduce the redundant alerts. Finally, the proposed scheme is applied to the CIC-IDS 2018 dataset and the DARPA 98 dataset. The experimental results show that this method can effectively reduce the redundant alerts and improve the efficiency of data processing, thus providing accurate and concise data for the next stage of alert fusion and analysis.

Granularity Approach for Multi-Criteria Decision Making About Hybrid Evaluation Information

In this study, a new version of TOPSIS method is reconstructed to deal with the problem of multi-criteria decision making. Here, the data representation of all alternatives is varied according to different criteria, such as real number, interval-valued number, set-valued number and intuitionistic fuzzy-valued number, etc. Because the distinguishing ability of each criterion can be reflected by its knowledge granularity, naturally, a knowledge granularity method is constructed to measure the criteria weights. Besides, the approach of how to select the ideal solution is redefined, especially for the case that the content of criterion according to all alternatives is not a totally ordered set anymore. What is more, the decision maker’s personal preference is considered, and the concrete indicator value can be calculated by the convex combination of the distance from possible alternatives to ideal solutions. Finally, the validity of the proposed decision-making algorithm is illustrated by a synthetic example.