作者: T. Subbulakshmi , S. Mercy Shalinie , C. Suneel Reddy , A. Ramamoorthi
DOI: 10.1007/978-3-642-14478-3_25
关键词: Computer science 、 False positive paradox 、 Intrusion detection system 、 Denial-of-service attack 、 Computer security 、 Testbed 、 Data mining 、 Alert fusion 、 Volume (computing) 、 Fuzzy inference system 、 Server
摘要: A DDoS attack saturates a network by overwhelming the resources with an immense volume of traffic that prevent normal users from accessing resources. When Intrusion Detection Systems are used, huge number alerts will be generated and these consist both False Positives True Positives. Due to traffic, there is possibility occurring more than which difficult for analyst classify original take remedial action. This paper focuses on development alert classification system related attacks. It consists five phases : Attack Generation, Alert Collection, Fusion, Generalization classification. In attacks in experimental testbed. snort IDS used generate testbed collected. repeated fused together form meta alerts. Alerts Generalization, indicating towards servers taken further analysis. Classification, using fuzzy inference classified as reduces difficulty eliminating false positives. tested