Intrusion detection alarms reduction using root cause analysis and clustering

Al‐Mamory, Safaa O.; Zhang, Hongli

doi:10.1016/j.comcom.2008.11.012

Cited by 76 publications

(49 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Thus, the error rate of the proposed method does not exceed 6.73%. Comparing these results with those obtained by [25], [26] and [9], we find that they all used the DARPA 1999 dataset for five weeks, and the results of the proposed module are significantly better than those they have reported (Table 9). Table 9 Comparisons between the proposed module and other approaches Table 9 shows that all researchers used the same dataset, but the obtained results of this module are given below.…”

Section: Accomplishment Experimentsmentioning

confidence: 35%

“…To generate an acceptable alert set, we used IDS Snort 2.9 in our experiments, which has the flexibility of providing alerts in a flat file [9]. Afterward, we conducted a preprocess to remove the symbols and convert the file to a CSV file on a table format to simplify its application in any system, including our proposed system.…”

Section: Accomplishment Experimentsmentioning

confidence: 99%

“…When the process contains several similarities, there is a high possibility of having normal behavior. A new technique based on data mining has been proposed by Al-Mamory and Zhang, [9] with the aim of reducing false positive alerts. The main idea of this technique is that alerts are gathered into a group of clusters where a generalized alert is created from each cluster by this technique.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Collection Mechanism and Reduction of IDS Alert

HashimAl-Saedi¹,

Ramadass²,

Almomani³

et al. 2012

IJCA

View full text Add to dashboard Cite

Numerous techniques and approaches are used to address the threats that are faced by computer networks today's. Some of these reactive approaches involve Intrusion Detection System (IDS), malware data mining and network monitoring. Numerous false positive alerts are generated by the IDS, contributing negatively to system complexity and performance. In this paper, we present a new framework called collection mechanism and reduction of IDS alert framework (CMRAF) to remove duplicate IDS alerts and reduce the amount of false alerts. CMRAF is based on two models. The first model develops a mechanism to save IDS alerts, extract the standard features as intrusion detection message exchange format, and save them in DB file (CSVtype). The second model consists of three phases. The first phase removes redundant alerts, the second phase reduces false alerts based on threshold time value, and the last phase reduces false alerts based on rules with threshold common vulnerabilities and exposure value. We applied CMRAF on two environments: the Darpa 1999 and the NAv6 network center data sets. The result obtained from the experiment on Darpa 1999 data set recorded an 92% alert reduction rate, whereas that on the NAv6 data set recorded an 84% alert reduction rate. From the results, CMRAF was able to scale back a massive quantity of redundant alerts and effectively reduces false alerts.

show abstract

Section: Accomplishment Experimentsmentioning

confidence: 35%

Section: Accomplishment Experimentsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Collection Mechanism and Reduction of IDS Alert

HashimAl-Saedi¹,

Ramadass²,

Almomani³

et al. 2012

IJCA

View full text Add to dashboard Cite

show abstract

“…The algorithm was used to identify the root cause of an attack, by manually analyzing and addressing these causes. This semi automatic process was enhanced further in [16], where the researches maintained the AOI techniques, and worked on the over generalization problem and computational setbacks in the previous work through developing a new approximation clustering algorithm while introducing the Nearest Common Ancestor (NCA) concept as a tool to calculate distance and initiate the cluster. For the purpose of our clustering method, data mining approaches applied are not suitable because of the generalization technique operates on pure assumption that objects or in this case alerts can be grouped together because they shared some common features or belong to the same ancestor.…”

Section: Related Workmentioning

confidence: 99%

“…In IDS, clustering is basically used for two things [14]; detection of hidden pattern in [15] to correlate alerts and establish causal relationship and as a data reduction technique in [3] and [16] to reduce the amount of alerts. Most clustering methods, used distant or similarity measure, between objects as a criterion to create a cluster, although the measuring approaches differs between individuals [17].…”

Section: Related Workmentioning

confidence: 99%

An Operational Framework for Alert Correlation using a Novel Clustering Approach

Mohamed¹,

Idris²,

Shanmugum³

2012

IJCA

View full text Add to dashboard Cite

Intrusion Detection System (IDS) is a well known security feature and widely implemented among practitioners. However, since the creation of IDS the enormous number of alerts generated by the detection sensors has always been a setback in the implementation environment. Moreover due to this obtrusive predicament, two other problems have emerged which are the difficulty in processing the alerts accurately and also the decrease in performance rate in terms of time and memory capacity while processing these alerts. Thus, based on the specified problems, the purpose of our overall research is to construct a holistic solution that is able to reduce the number of alerts to be processed and at the same time to produce a high quality attack scenarios that are meaningful to the administrators in a timely manner. In this paper we will present our proposed framework together with the result of our novel clustering method, architectured solely with the intention of reducing the amount of alerts generated by IDS. The clustering method was tested against two dataset; a globally used dataset, DARPA and a live dataset from a cyber attack monitoring unit that uses SNORT engine to capture the alerts. The result obtained from the experiment is very promising; the clustering algorithm was able to reduce about 86.9% of the alerts used in the experiment. From the result we are able to highlight the contribution to practitioners in an actual working environment.

show abstract

An efficient approach to reduce alerts generated by multiple IDS products

2014

View full text Add to dashboard Cite

Intrusion detection systems (IDSs) often trigger a huge number of unnecessary alerts. Managing the overwhelming number of alerts, especially from multiple IDS products, is a concern to every security analyst. Analyzing and evaluating these alerts is a difficult task that frustrates the effort of analysts. In fact, true alerts are usually buried under heaps of false alerts. We have identified several research gaps in the existing alert management approaches that need to be addressed, especially when handling alerts from different IDS products. In this work, we present an efficient alert management approach that reduces the unnecessary alerts produced by different IDS products using two main modules: an enhanced alert verification module that validates alerts with vulnerability assessment data; and an enhanced alert aggregator module that reduces redundant alerts and presents them in the form of meta alerts. Finally, we have carried out experiments in our test bed and recorded impressive results in terms of high accuracy and low false positive rate for multiple IDS products.

show abstract

Intrusion detection alarms reduction using root cause analysis and clustering

Cited by 76 publications

References 20 publications

Collection Mechanism and Reduction of IDS Alert

Collection Mechanism and Reduction of IDS Alert

An Operational Framework for Alert Correlation using a Novel Clustering Approach

An efficient approach to reduce alerts generated by multiple IDS products

Contact Info

Product

Resources

About