Reducing the Overlap among Hierarchical Clusters with a GA-Based Approach

Intrusion detection systems generally trigger a great number of alarms which often overwhelm their human operators. A kind of hierarchical clustering approach can help the operators to get a meaningful overview of the alarms by generating clusters one by one. But the clusters obtained generally overlap much, which makes the operators be likely to misunderstand what really happened in the network. We present an extension of the clustering approach using a genetic algorithm based upon a new kind of fitness heuristic. This heuristic "intelligently" guides the selection based upon feedback concerning the overlap among the clusters. Unlike the original approach that generates one cluster after another, our implementation generates all clusters at a time. The experiment results are quite encouraging, including that our approach can generate high-quality clusters, the overlap among which is greatly reduced.