False alarm minimization techniques in signature-based intrusion detection systems: A survey

Abstract

A network based Intrusion Detection System (IDS) gathers and analyzes network packets and report possible low level security violations to a system administrator. In a large network setup, these low level and partial reports become unmanageable to the administrator resulting in some unattended events. Further it is known that state of the art IDS generate many false alarms. There are techniques proposed in IDS literature to minimize false alarms, many of which are widely used in practice in commercial Security Information and Event Management (SIEM) tools. In this paper, we review existing false alarm minimization techniques in signature-based Network Intrusion Detection System (NIDS). We give a taxonomy of false alarm minimization techniques in signature-based IDS and present the pros and cons of each class. We also study few of the prominent commercial SIEM tools which have implemented these techniques along with their performance. Finally, we conclude with some directions to the future research.

False alarm reduction in signature‐based IDS: game theory approach

“…However, this approach requires alteration of attack signatures and rebooting of the IDS engine. Numerous works on false alarm minimization have been proposed in the literature with varying degree of success . In general, enhancing the IDS's accuracy by minimizing its FP alarm rate also decreases its detection rate by increasing its false negative rate.…”

Network Security Architecture with Active and Dynamic Response Selection

“…But, most existing IRS designs employ a static approach in selecting an optimum response for intrusion alerts generated by the IDSs [5]. Instead of dynamic response, several existing [6] [7] only used static response strategies. This includes the static risk threshold metric, damage reduction metric, IDS confidence metric and severity metric.…”

Designing a context-aware cyber physical system for detecting security threats in motor vehicles

“…The major concern with such systems is that they attempt to detect a very wide range of events, which often results in high false alarm rate [5]. The main cause of an excessive number of wrong detections is often attributed to a plethora of suspicious cases.…”

“…Similar to Intrusion Detection Systems, TDS might be divided into two broad classes: pattern-based and anomaly-based. The former uses a database of known threat patterns and raises an alarm whenever similar pattern(s) occur, whereas the later uses a certain model of system behaviour and observes significant deviations from it [5].…”