A test of intrusion alert filtering based on network information

Abstract

Intrusion detection systems continue to be a promising security technology. The arguably biggest problem with today's intrusion detection systems is the sheer number of alerts they produce for events that are regarded as benign or non‐critical by system administrators. A plethora of more and less complex solutions has been proposed to filter the relevant (i.e., correct) alerts that signature‐based intrusion detection sensors produce. This paper reports on a test performed to test a number of filtering alternatives that take advantage of information about static properties of the monitored computer network, such as vulnerabilities and exposure of ports and hosts. The results show that none of the filters are able to maintain a high recall (portion of detected attacks) while increasing the precision (portion of relevant alerts). At most, precision increased from 1.4% to 2.9%, and this also resulted in a decrease in recall from 44% to 26%. Even when combined in an exploratory fashion, the filters fail to provide improved precision. It is concluded that filters based on static properties of the computer network do not result in clear improvements to alert lists produced by signature‐based intrusion detection systems. Copyright © 2015 John Wiley & Sons, Ltd.

Discovering Coordinated Groups of IP Addresses Through Temporal Correlation of Alerts

“…These issues are approached from various perspectives which can be summarized into filtration [4], aggregation [5], prioritization [6] and correlation [7]. Since the correlation techniques are the most relevant for our research, we further elaborate on them in our related work.…”

Variables influencing the effectiveness of signature-based network intrusion detection systems

“…The problem with false positives is substantial. For example, Tjhai et al (2008) reported that 96% of the alerts were false positives in a test where Snort monitored a university's web server, Sommestad and Franke (2015) reported that greater than 98% of the alerts Snort produced during a cyber security exercise were false positives, and Cotroneo et al (2019) refers to analyses were 99% of the alerts are false positives. The problem of detecting attacks is also considerable and a frequent argument against signature-based NIDSs and for the use of anomaly based alternatives is that signature-based solutions are poor at detecting undisclosed (zero-day) exploits (Liao et al, 2013) (Patcha & Park, 2007) (Holm, 2014) (Khraisat et al, 2019).…”