@inproceedings{dda5cee99add4956a1a387afa5fe607d,
title = "Hierarchical clustering and visualization of aggregate cyber data",
abstract = "Most commercial intrusion detections systems (IDS) can produce a very high volume of alerts, and are typically plagued by a high false positive rate. The approach described here uses Splunk to aggregate IDS alerts. The aggregated IDS alerts are retrieved from Splunk programmatically and are then clustered using text analysis and visualized using a sunburst diagram to provide an additional understanding of the data. The equivalent of what the cluster analysis and visualization provides would require numerous detailed queries using Splunk and considerable manual effort.",
keywords = "IDS analysis, hierarchical clustering, sunburst visualization, vector space model",
author = "Patton, {Robert M.} and Beaver, {Justin M.} and Steed, {Chad A.} and Potok, {Thomas E.} and Treadwell, {Jim N.}",
year = "2011",
doi = "10.1109/IWCMC.2011.5982725",
language = "English",
isbn = "9781424495399",
series = "IWCMC 2011 - 7th International Wireless Communications and Mobile Computing Conference",
pages = "1287--1291",
booktitle = "IWCMC 2011 - 7th International Wireless Communications and Mobile Computing Conference",
note = "7th International Wireless Communications and Mobile Computing Conference, IWCMC 2011 ; Conference date: 04-07-2011 Through 08-07-2011",
}