FALSE POSITIVE REDUCTION IN INTRUSION DETECTION SYSTEM: A SURVEY

摘要：

Since the first intrusion detection system and up to this moment all IDSs had generated thousands and thousands of alerts and most of these alerts are false alerts, which lead the researchers to develop an idea to reduce the rate of the alerts or at least the false alerts of them. One of the ideas was to create correlation methods which cover the problem of dealing with the huge amount of both real alerts as well as false alerts. The techniques used in this area plan to help the analyst party to analyze these alerts to distinguish between alerts generated by real attacks and legal traffic. This paper will highlight the false positive reduction techniques surrounding this area.

关键词： Computer security Intrusion Detection System False Positive Alerts Alert Correlation

作者: Omar Abouabdalla Homam El-Taj Ahmed Manasrah Sureswaran Ramadass

作者单位: Universiti Sains Malaysia,National Advanced IPv6 Centre (NAv6)

会议类型: 国际会议

会议名称: 2009 2nd IEEE International Conference on Broadband Network & Multimedia Technology(2009年宽带网络与多媒体国际会议 IEEE IC-BNMT2009)

会议地点: 北京

会议语种:英文

页码: 463-466

在线出版日期: 2009-10-18（万方平台首次上网日期，不代表论文的发表时间）