An intrusion detection and alert correlation approach based on revising probabilistic classifiers using expert knowledge

Benferhat, Salem; Boudjelida, Abdelhamid; Tabia, Karim; Drias, Habiba

doi:10.1007/s10489-012-0383-7

Cited by 40 publications

(21 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As stated previously, developing systems that are absolutely exploit free is very difficult and close to impossible in the positive and negative IDS alerts [17]. And this become a greater endeavor because regardless of what procedures are in place, an organization is still at risk not only from external attacks but also from the ones from within [35].…”

Section: Researchmentioning

confidence: 99%

“…IDS do have three areas of interests that most researchers do address to highlight the problem that impair the reliability and effectiveness of detecting harmful actions and to help raise the correct alert [17]. Investigating IDS to mitigate the increase of computer crimes will be effective to reduce loss due to theft and help maintaining the integrity of personal and financial data [14][56].…”

Section: Ids Problemsmentioning

confidence: 99%

“…There are many theories on how to improve IDS deficiency when it comes to anomaly detection to allow the alert management to help investigate logical patterns among incidents [60]. For instance, legitimate activities are not correctly detected by IDS and anomalies are referred as valid activities [17]. However, the disadvantage lies in false alarms due to authorized users and their behaviors causing the misidentification due to misconfigurations of the system [21].…”

Section: Current System Flawsmentioning

confidence: 99%

“…However, the disadvantage lies in false alarms due to authorized users and their behaviors causing the misidentification due to misconfigurations of the system [21]. Anomaly detection works by analyzing the historical data by detecting irregularities that differ from usual conditions [17].…”

Section: Current System Flawsmentioning

confidence: 99%

See 3 more Smart Citations

Discovering New Cyber Protection Approaches from a Security Professional Prospective

Loukaka¹,

Rahman²

2017

IJCNC

View full text Add to dashboard Cite

Cybersecurity has become a very hot topic due to high profile breaches that occurred in the past years. Despite the implementation of current known pre-emptive methods such as intrusion detection systems, anti-viruses, and the use of firewalls, hackers still find sophisticated means to steal data or impair an organization by targeting their assets. It is important that security professionals need to "think outside the box" and use new tools and techniques to mitigate threats beyond current known detections and prevention technologies. It is imperative that our infrastructure and assets are impermeable from domestic and foreign attackers. Our best line of defense is the detection of any threats or vulnerability to prevent or minimize damages of our assets from domestic and foreign attackers.

show abstract

Section: Researchmentioning

confidence: 99%

Section: Ids Problemsmentioning

confidence: 99%

Section: Current System Flawsmentioning

confidence: 99%

Section: Current System Flawsmentioning

confidence: 99%

See 2 more Smart Citations

Discovering New Cyber Protection Approaches from a Security Professional Prospective

Loukaka¹,

Rahman²

2017

IJCNC

View full text Add to dashboard Cite

show abstract

“…For such variants i ∈ N , the new degrees are 0s: µ ′ i = 0. For variants from the "yes"-set Y , the new degree can be obtained by one of two different ways (see, e.g., [1], [2], [3], [4], [5], [6], [7], [8], [10]):…”

Section: Formulation Of the Problem In Precise Terms: Case Of Fuzzmentioning

confidence: 99%

Coming up with a good question is not easy: A proof

Lorkowski

Longpré

Kosheleva

et al. 2015

2015 Annual Conference of the North American Fuzzy Information Processing Society (NAFIPS) Held Jointly With 2015 5th World Con

Self Cite

View full text Add to dashboard Cite

Abstract-Ability to ask good questions is an important part of learning skills. Coming up with a good question, a question that can really improve one's understanding of the topic, is not easy. In this paper, we prove -on the example of probabilistic and fuzzy uncertainty -that the problem of selecting of a good question is indeed hard. I. FORMULATION OF THE PROBLEMAsking good questions is important. Even after a very good lecture, some parts of the material remain not perfectly clear. A natural way to clarify these parts is to ask questions to the lecturer.Ideally, we should be able to ask a question that immediately clarifies the desired part of the material. Coming up with such good questions is an important part of learning process, it is a skill that takes a long time to master.Coming up with good questions is not easy: an empirical fact. Even for experienced people, it is not easy to come up with a good question, i.e., with a question that will maximally decrease uncertainty.What we do in this paper. In this paper, we prove that the problem of designing a good question is indeed computationally difficult (NP-hard).We will show this both for probabilistic and for fuzzy uncertainty. Specifically, we will prove NP-hardness for the simplest types of questions -for "yes"-"no" questions for which the answer is "yes" or "no". Since already designing such simple questions is NP-hard, any more general problem (allowing more complex problems) is NP-hard as well. II. TOWARDS DESCRIBING THE PROBLEM IN PRECISETERMS: GENERAL CASE

show abstract

False alarm reduction in signature‐based IDS: game theory approach

Subba

Biswas

Karmakar

2016

Security Comm Networks

View full text Add to dashboard Cite

Signature‐based intrusion detection systems (IDSs) are employed to monitor computer networks for signs of network intrusions. However, they produce a large number of false positive alarms when operated with default settings without considering the underlying network environment. Inundation of false alarms is the Achilles heel of IDS technology, which could render the IDS ineffective in detecting network attacks. Several false alarm minimization approaches have been proposed in the literature. However, there are many drawbacks associated with these works, namely, modification of well‐established attack signatures; heavy dependence on the attack signatures' reference numbers, which might not always be available; and non‐consideration of the underlying network context information. In this paper, we propose an efficient game theory‐based false alarm minimization scheme for signature‐based IDS. The proposed scheme uses a game theory‐based correlation engine to correlate IDS alarms with network vulnerabilities to minimize the overall false positive alarm rate of the IDS. Experimental results and comparison analysis of the proposed false alarm minimization framework with other frameworks on the benchmark DARPA intrusion detection evaluation dataset and an in‐house IIT Guwahati Lab dataset show that the proposed scheme achieves the highest accuracy among all the frameworks under consideration without degrading the overall detection rate of the IDS. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

An intrusion detection and alert correlation approach based on revising probabilistic classifiers using expert knowledge

Cited by 40 publications

References 36 publications

Discovering New Cyber Protection Approaches from a Security Professional Prospective

Discovering New Cyber Protection Approaches from a Security Professional Prospective

Coming up with a good question is not easy: A proof

False alarm reduction in signature‐based IDS: game theory approach

Contact Info

Product

Resources

About