Data Mining Based Technique for IDS Alerts Classification
نویسندگان
چکیده
Intrusion detection systems (IDSs) have become a widely used measure for security systems. The main problem for those systems results is the irrelevant alerts on those results. We will propose a data mining based method for classification to distinguish serious alerts and irrelevant one with a performance of 99.9 % which is better in comparison with the other recent data mining methods that have reached the performance of 97%. A ranked alerts list also created according to alert’s importance to minimize human interventions. Keyword: Intrusion Detection, Data Mining, Frequent Pattern, Frequent Itemset
منابع مشابه
Classification of IDS Alerts with Data Mining Techniques
Intrusion detection systems (IDSs) have become a widely used measure for security, but we still have a problem on those systems results which includes many irrelevant alerts, so we will propose a data mining based method for classification to distinguish serious alerts and irrelevant one with the performance of 99.9 % in comparison with the other recent data mining methods which have reached th...
متن کاملEffective Intrusion Detection System using Data Mining Technique
Network Security has become the key foundation with the tremendous increase in usage of network-based services and information sharing on networks. Intrusion poses a serious risk to the network security and compromise integrity, confidentiality & availability of the computer and network resources. Human classification of network audit data is expensive, time consuming and a tedious job. Intrusi...
متن کاملAlert correlation and prediction using data mining and HMM
Intrusion Detection Systems (IDSs) are security tools widely used in computer networks. While they seem to be promising technologies, they pose some serious drawbacks: When utilized in large and high traffic networks, IDSs generate high volumes of low-level alerts which are hardly manageable. Accordingly, there emerged a recent track of security research, focused on alert correlation, which ext...
متن کاملAn Outlier Detection-Based Alert Reduction Model
Intrusion Detection Systems (IDSs) are widely deployed with increasing of unauthorized activities and attacks. However they often overload security managers by triggering thousands of alerts per day. And up to 99% of these alerts are false positives (i.e. alerts that are triggered incorrectly by benign events). This makes it extremely difficult for managers to correctly analyze security state a...
متن کاملA Novel Data Mining-Based Method for Alert Reduction and Analysis
Current system managers often have to process huge amounts of alerts per day, which may be produced by all kinds of security products, network management tools or system logs. This has made it extremely difficult for managers to analyze and react to threats and attacks. So an effective technique which can automatically filter and analyze alerts has become urgent need. This paper presents a nove...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
- CoRR
دوره abs/1211.1158 شماره
صفحات -
تاریخ انتشار 2012