Abstract:Nowadays, advanced intrusion detection systems (IDSs) rely on a combination of anomaly detection and signature-based methods. An IDS gathers observations, analyzes behavioral patterns, and reports suspicious events for further investigation. A notorious issue anomaly detection systems (ADSs) and IDSs face is the possibility of high false alarms, which even state-of-the-art systems have not overcome. This is especially a problem with large and complex systems. The number of non-critical alarms can easily overwhelm administrators and increase the likelihood of ignoring future alerts. Mitigation strategies thus aim to avoid raising `too many' false alarms without missing potentially dangerous situations. There are two major categories of false alarm-mitigation strategies: (1) methods that are customized to enhance the quality of anomaly scoring; (2) approaches acting as filtering methods in contexts that aim to decrease false alarm rates. These methods have been widely utilized by many scholars. Herein, we review and compare the existing techniques for false alarm mitigation in ADSs. We also examine the use of promising techniques in signature-based IDS and other relevant contexts, such as commercial security information and event management tools, which are promising for ADSs. We conclude by highlighting promising directions for future research.

A Method for False Alarm Recognition Considering Threshold

A Method of False Alarm Recognition Based on K-Nearest Neighbor

Real-time Detection of False Data Injection Attack Using Residual Prewhitening in Smart Grid Network.

Multi-State Adaptive BIT False Alarm Reduction under Degradation Process

An Approach to Fault Diagnosis Considering False Alarm and Middle State

An Adaptive Threshold Algorithm Based on the Principle of Satisfactory Filtering

Method of Reducing False Positive Alerts Based on Support Vector Machine in Intrusion Detection

New Analytical Approach to Detection Threshold of A Dynamic Programming Track-Before-Detect Algorithm

Study of Intrusion Detection Based on Alarm Deviation Analysis

Improved Threshold for the Local Approach in Detecting Faults

Study of Monitoring False Data Injection Attacks Based on Machine-learning in Electric Systems

An Adaptive Threshold Algorithm Based on Satisfactory Filtering Principle

Detection of Weak Monocycle Sinusoidal Signals with a Low Constant False Alarm Rate Based on the Support Vector Machine

An Approach to Filter False Positive Alerts Based on RS-SVM Theory

Reduction of false positives in intrusion detection via adaptive alert classifier

Research on Voiceprint Recognition of Electrical Faults with Lower False Alarm Rate

An Alarm Method for a Loose Parts Monitoring System

An Efficient Detection Algorithm for Decreasing False Alarm Rate of Infrared Surveillance System

Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Low false reject rate and false accept rate multi-step fire detection method