.png){kind=icon}
返回
Human-in-the-Loop Cyber Intrusion Detection Using Active Learning
.png){kind=icon}
OA
AI
DOI：10.1109/TIFS.2024.3434647.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Timely detection of cyber attacks is essential for minimizing attack impact, but it requires accurate real-time situational awareness (SA). In practice, SA is hampered by frequent false alerts from anomaly-based intrusion detection systems (IDS), causing alarm fatigue. Investigating alerts by humans can enhance SA, but it is resource-intensive and it is often unclear which alerts to prioritize. In this paper, we propose a framework for optimizing human-in-the-loop attack detection, consisting of three key components: 1) dynamic alert prioritization, which ranks alerts based on previous alerts and investigations, 2) human alert investigation, referring to the manual analysis of alerts, and 3) sequential hypothesis testing, a method that confirms a hypothesis based on incoming alerts, with pruned hidden Markov models (HMMs). We formulate the problem as that of active learning in an HMM, and we propose two alert prioritization policies, namely Max Ratio and Max KL. The proposed policies aim to select the most informative alerts based on historical data and prior investigations, thereby minimizing the detection time. Simulation results show that our proposed policies reduce the time to detection by up to 79% compared to a static baseline policy, while maintaining a target mean time between false detections (MTBFD).
Keyword:
Situational awareness
intrusion detection
active learning
hidden Markov model
multihypothesis testing
Situational awareness
intrusion detection
active learning
hidden Markov model
multihypothesis testing
期刊
IF:
8
论文数:
5.2K
被引数:
2.3W
机构
引用论文
Surgical site infection after hip replacement due to a novel Peptoniphilus species, provisionally named ‘Peptoniphilus nemausus’ sp. nov..png)
Anaerobe
OAAI
AnaerobeIF0
OAAI分享收藏
查看更多内容