Data mining and machine learning-Towards reducing false positives in intrusion detection

摘要: Intrusion Detection Systems (IDSs) are used to monitor computer systems for signs of security violations. Having detected such signs, IDSs trigger alerts report them. These presented a human analyst, who evaluates them and initiates an adequate response. In practice, have been observed thousands per day, most which mistakenly triggered by benign events (i.e., false positives). This makes it extremely difficult the analyst correctly identify related attacks true this paper, we present two orthogonal complementary approaches reduce number positives in intrusion detection using alert postprocessing data mining machine learning. Moreover, these techniques, because their nature, can be together alert-management system. concepts verified on variety sets, achieved significant reduction both simulated real environments.