Research on IDS Alert Aggregation Based on Improved Quantum-behaved Particle Swarm Optimization

In this paper we propose a new approach to reduce excessive duplicate alerts and high false positive rates in IDS. We used an improved quantum-behaved particle swarm optimization (IQPSO) algorithm byintroducing multiple segment processing and absorption wall. During Alert aggregation processing, wecalculate similarity of alert by fuzzy membership function firstly, then optimize attribute weights a similarity threshold by IQPSO. Experimental results show that the algorithm is effective in alert aggregation and gives better results in reducing false positive rate and duplicate alerts.