Scholarlink

<p>In response to the limitations of existing network security alert screening methods in handling high-noise and incomplete data, this paper proposes a multi-level alert screening framework based on DBSCAN density clustering and RETE rule reasoning. The proposed method achieves adaptive analysis and precise screening of alert data by constructing a multi-stage processing pipeline that integrates density clustering, fuzzy reasoning, and dynamic neural networks. Key innovations include: employing the DBSCAN algorithm to perform unsupervised clustering and noise identification of alert data; introducing an improved RETE rule reasoning mechanism that supports weighted fuzzy matching to enhance fault tolerance for incomplete alert streams; and designing a BP neural network with dynamically adjustable structure to achieve accurate alert classification. Experimental results demonstrate that the proposed method achieves significant performance advantages on multiple real-world and benchmark datasets, with a true positive rate of 96.6%, a noise rate controlled within 18.7%, and CPU utilization below 1%, substantially outperforming existing mainstream solutions and exhibiting high practical application value.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Multi-level screening method for network security alarms based on DBSCAN algorithm and rete rule inference

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年1月17日

查看全文
  • Lin Ni,
  • Shuai Zhang,
  • Kun Huang,
  • Yifan Wang

摘要

In response to the limitations of existing network security alert screening methods in handling high-noise and incomplete data, this paper proposes a multi-level alert screening framework based on DBSCAN density clustering and RETE rule reasoning. The proposed method achieves adaptive analysis and precise screening of alert data by constructing a multi-stage processing pipeline that integrates density clustering, fuzzy reasoning, and dynamic neural networks. Key innovations include: employing the DBSCAN algorithm to perform unsupervised clustering and noise identification of alert data; introducing an improved RETE rule reasoning mechanism that supports weighted fuzzy matching to enhance fault tolerance for incomplete alert streams; and designing a BP neural network with dynamically adjustable structure to achieve accurate alert classification. Experimental results demonstrate that the proposed method achieves significant performance advantages on multiple real-world and benchmark datasets, with a true positive rate of 96.6%, a noise rate controlled within 18.7%, and CPU utilization below 1%, substantially outperforming existing mainstream solutions and exhibiting high practical application value.