Network IDS Duplicate Alarm Reduction Using Improved SNM Algorithm

Intrusion detection system is an effective defense tool for finding security events. However, it will produce a large number of false positive alerts, which greatly increases the difficulty of real-time security analysis for the security managers, in actual applications. The periodic alarm produced by the wrong configuration of network devices and services, and the approximately duplicate alarm generated by different IDS for the same attack are important components of false alarm. In this paper, we improved the SNM algorithm and cleaned up the duplicate alarm in the original alarm database, which reduced the scale of the database; On the other hand, we have made statistics on the number of duplicate alarms, so that we can further find periodic alerts and remove false alarms.