Prioritizing intrusion analysis using Dempster-Shafer theory

摘要: Intrusion analysis and incident management remains a difficult problem in practical network security defense. The root cause of this is the large rate false positives sensors used by Detection System (IDS) systems, reducing value alerts to an administrator. Standard Bayesian theory has not been effective regard because lack good prior knowledge. This paper presents approach handling such uncertainty without need for information, through Dempster-Shafer (DS) theory. We address number but fundamental issues applying DS intrusion analysis, including how model sensors' trustworthiness, where obtain parameters, independence among alerts. present efficient algorithm carrying out belief calculation on IDS alert correlation graph, so that one can compute score given hypothesis, e.g. specific machine compromised. strength be sort incident-related hypotheses prioritize further human analyst associated evidence. have implemented our open-source system Snort evaluated its effectiveness data sets as well production network. resulting scores were verified both anecdotal experience comparing rankings with ground truths provided we evaluation, showing thereby mitigating high positive analysis.