A Skyline Based False Alarm Reduction in Intrusion Detection Systems

다국어 초록 (Multilingual Abstract)

Recent expansion of the Internet has caused to emerge lots of malicious threats. Though various Intrusion Detection Systems (IDSs) have been proposed so far, none of them has completely coped with the emerged issues. Once IDS finishes its performance, lots of false alarms can be produced, which can lead to increasing burden in network administrator's work. Therefore, it is necessary to have a system for post-processing of the false alarms that can operate after intrusion detection process finishes its work, and divide false alarms into secure data packets and attacks. In this paper, we propose to select only top-k false alarms that pose a threat to the system. Our approach is to formulate the existing issue as a selection problem with which skyline queries can handle fast and efficiently. In this paper, we utilize Sort-Filter-Skyline (SFS) algorithm that constructs skylines by finding only such data points that are not dominated by other data points. In the context of the proposed method, we perform a skyline operation on false alarms, and extract alarms that are not dominated by other alarms. These alarms are potential candidates to become secure data packets or attacks. Experiments show that the proposed method outperforms other methods on reducing false positive and false negative, while maintaining the acceptable computational time and memory usage.

참고문헌 (Reference)

1 Brumley D, "Towards Automatic Generation of Vulnerability-Based Signatures" 2-16, 2006

2 Chomicki, J, "Skyline with presorting" 717-719, 2003

3 Viinikka J, "Processing intrusion detection alert aggregates with time series modeling" 312-324, 2009

4 Hassani M, "Network Intrusion Detection using a Secure Ranking of Hidden Outliers" 1-10, 2011

5 Tajbakhsh, R, "Intrusion detection using fuzzy association rules" 9 : 462-469, 2009

6 Treinen J.J, "Finding The Needle: Suppression of False Alarms in Large Intrusion Detection Data Sets" 237-244, 2009

7 Julisch K, "Clustering Intrusion Detection Alarms to Support Root Cause Analysis" 443-471, 2003

8 Bolzoni D, "ATLANTIDES: An Architecture for Alert Verification in Network Intrusion Detection Systems" (1-12) : 2007