.png){kind=icon}
.png){kind=icon}
Return
Enhancing IDS performance through comprehensive alert post-processing
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2013.03.005.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Intrusion detection systems (IDS) are among the most common countermeasures against network attacks. In order to improve the alerts obtained from them, various methods of post-processing have been proposed. These methods usually try to alleviate specific drawbacks of intrusion detection. We propose a system that is a post-processing solution. The input of our system is a set of multiple IDS sensors alert sets. Each set's alerts are aggregated in order to improve their quality, before multiple alert sets merge into one general alert set. Then, a low clustering procedure allows the system to hypothesize about missed security events and to create relevant alerts. The main clustering phase comes next, before the final step, in which a clusters graph is generated to produce a high level presentation of the security events. The system has been tested using the DARPA 2000 dataset, as well as a live network dataset, and has produced satisfactory results. (c) 2013 Elsevier Ltd. All rights reserved.
Keywords:
Intrusion detection systems
Aggregation
Correlation
Prediction
Visualization
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W