Abstract:Current system managers often have to process huge amounts of alerts per day, which may be produced by all kinds of security products, network management tools or system logs. This has made it extremely difficult for managers to analyze and react to threats and attacks. So an effective technique which can automatically filter and analyze alerts has become urgent need. This paper presents a novel method for handling IDS alerts more efficiently. It introduces a new data mining technique, outlier detection, into this field, and designs a special outlier detection algorithm for identifying true alerts and reducing false positives (i.e. alerts that are triggered incorrectly by benign events). This algorithm uses frequent attribute values mined from historical alerts as the features of false positives, and then filters false alerts by the score calculated based on these features. We also proposed a three-phrase framework, which not only can filter newcome alerts in real time, but also can learn from these alerts and automatically adjust the filtering mechanism to new situations. Moreover our method can help managers analyze the root causes of false positives. And our method needs no domain knowledge and little human assistance, so it is more practical than current ways. We have built a prototype implementation of our method. Through the experiments on DARPA 2000, we have proved that our model can effectively reduce false positives. And on real-world dataset, our model has even higher reduction rate. By comparing with other alert reduction methods, we believe that our model has better performance.

Design and Implementation of Intrusion Detection System Alerts Fusion Model

Use of host's software information to mitigate false positive in signature-based NIDS

An Intrusion Detection Framework Based on Information Fusion

Multi-agent based hybrid Intrusion detection system

Hybrid Intrusion Detection System for Complicated Network

Research on Data Mining-based Intrusion Detection in Real-time Environment

Intrusion Detection And Simulation For High-Speed Networks

A Novel Decision Fusion Scheme with Feedback in Neyman-Pearson Detection Systems.

Alert reduction for network intrusion detection

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

A Novel Data Fusion Algorithm to Combat False Data Injection Attacks in Networked Radar Systems

Data fusion and network intrusion detection systems

A knowledge fusion based intrusion detection model

Hybrid Network Intrusion Detection System

Multiple behavior information fusion based quantitative threat evaluation

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Design of Intelligent Fire Alarm System Based on Multisensor Data Fusion

Security Framework of Network-Attached Storage Based on Information Fusion

A Novel Data Mining-Based Method for Alert Reduction and Analysis.

The Research of Alert Correlation Based on Attack Intetion

Study and Implementation of a Net-based Intrusion Detection System