Abstract:The exponential expansion of Internet interconnectivity has led to a dramatic increase in cyber-attack alerts, which contain a considerable proportion of false positives. The overwhelming number of false positives cause tremendous resource consumption and delay responses to the really severe incidents, namely, alert fatigue. To cope with the challenge from alert fatigue, we focus on enhancing the capability of detectors to reduce the generation of false alerts from the detection perspective. The core idea of our work is to train a machine-learning-based detector to grasp the empirical intelligence of security analysts to estimate the feasibility of an incoming HTTP request to cause substantial threats, and integrate the estimation into the detection stage to reduce false alarms. To this end, we innovatively introduce the concept of attack feasibility to characterize the composition rationality of an inbound HTTP request as a feasible attack under static scrutinization. First, we adopt a fast request-reorganization algorithm to transform an HTTP request into the form of interface:payload pair for further alignment of structural components which can reveal the processing logic of the target program. Then, we build a dual-channel attention-based circulant convolution neural network (DualAC2NN) to integrate the attack feasibility estimation into the alert decision, by comprehensively considering the interface sensitivity, payload maliciousness, and their bipartite compatibility. Experiments on a real-world dataset show that the proposed method significantly reduces invalid alerts by around 86.37% and over 61.64% compared to a rule-based commercial WAF and several state-of-the-art methods, along with retaining a detection rate at 97.89% and a lower time overhead, which indicates that our approach can effectively mitigate alert fatigue from the detection perspective.

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Use of host's software information to mitigate false positive in signature-based NIDS

A Novel Data Mining-Based Method for Alert Reduction and Analysis.

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

Reduction on False Positive Rate of Anomaly IDS

Class Outlier Detection Algorithm and Application in IDS Model

Discovering Anomaly on the Basis of Flow Estimation of Alert Feature Distribution

Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

Alert reduction for network intrusion detection

Detection of Outliers Using Interquartile Range Technique from Intrusion Dataset

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Unraveling False Positives in Unsupervised Defect Detection Models: A Study on Anomaly-Free Training Datasets

DualAC2NN: Revisiting and Alleviating Alert Fatigue from the Detection Perspective

Enhancing Anomaly Detection Models for Industrial Applications through SVM-Based False Positive Classification

Hybrid Network Intrusion Detection System

Effective Feature Extraction for Intrusion Detection System using Non-negative Matrix Factorization and Univariate analysis

AnyThreat: An Opportunistic Knowledge Discovery Approach to Insider Threat Detection

Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset