IDS alerts classification using knowledge-based evaluation
Abstract
Most organizations deploy Signature based Intrusion Detection Systems (IDS) to monitor network activities for signs of security violations and these systems generate alerts whenever a known intrusion signature is detected in the network traffic. However, IDSs are known for generating many alerts, most of them being false. This makes the job of security analyst tougher as he/she has to sift through security events to filter out relevant alerts. In this process, the high priority alerts are not addressed quickly and there is a great risk of a legitimate attack going unnoticed. Many researchers have suggested various means of classifying the IDS alerts. A potentially useful candidate is to use network contextual information to segregate relevant and non-relevant alerts. In this paper we describe PIKE, Post-processor for IDS alerts using Knowledge-based Evaluation, a system that uses background information about the hosts present on the network and the vulnerability exploited to generate a score for each alert. The score is measure of the importance of the alert. A simple binary classifier then classifies the alert as relevant or irrelevant based on value of score threshold. PIKE makes the life of security analyst simpler by presenting the classified alerts which allows him/her to focus solely on the important alerts. We evaluate PIKE for a custom dataset and demonstrate the effectiveness of using contextual sensitivity as a basis of classification.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The normal activity profile in AIDS is tailored to specific networks and applications.
“and the fact that the normal activity profile is tailored to specific networks and applications [91].”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [91]
Cites
(1992) · Cited by 23,431 · see citing works
The use of the area under the ROC curve in the evaluation of machine learning algorithms
Bradley, A. P. (1997) · Pattern Recognition · doi:10.1016/s0031-3203(96)00142-2 · Cited by 7,217 · see citing works
Denning, D. E. (1987) · IEEE Transactions on Software Engineering · doi:10.1109/tse.1987.232894 · Cited by 3,428 · see citing works
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094 · see citing works
A Probabilistic Interpretation of Precision, Recall and F-Score, with Implication for Evaluation
Goutte, C., & Gaussier, E. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31865-1_25 · Cited by 2,285 · see citing works
Assessing the accuracy of prediction algorithms for classification: an overview
Baldi, P., Brunak, S., Chauvin, Y., Andersen, C. A. F., & Nielsen, H. (2000) · Bioinformatics · doi:10.1093/bioinformatics/16.5.412 · Cited by 2,111 · see citing works
Anomaly-based network intrusion detection: Techniques, systems and challenges
García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009) · Computers & Security · doi:10.1016/j.cose.2008.08.003 · Cited by 2,085 · see citing works
Scaling up the accuracy of Naive-Bayes classifiers: a decision-tree hybrid
Kohavi, R. (1996) · Cited by 1,404 · see citing works
Advances in Record-Linkage Methodology as Applied to Matching the 1985 Census of Tampa, Florida
Jaro, M. A. (1989) · Journal of the American Statistical Association · doi:10.1080/01621459.1989.10478785 · Cited by 1,401 · see citing works
Computer security threat monitoring and surveillance
Anderson, J. (1980) · Medical Entomology and Zoology · Cited by 1,342 · see citing works
A k-nearest neighbor classification rule based on Dempster-Shafer theory
Denœux, T. (1995) · IEEE Transactions on Systems Man and Cybernetics · doi:10.1109/21.376493 · Cited by 1,019 · see citing works
A k-Nearest Neighbor Classification Rule Based on Dempster-Shafer Theory
Denœux, T. (2008) · Springer eBooks · doi:10.1007/978-3-540-44792-4_29 · Cited by 833 · see citing works
Using Adaptive Alert Classification to Reduce False Positives in Intrusion Detection
Pietraszek, T. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30143-1_6 · Cited by 204 · see citing works
The Power Mean and the Logarithmic Mean
Lin, T. (1974) · American Mathematical Monthly · doi:10.1080/00029890.1974.11993684 · Cited by 169 · see citing works
Reducing false positives in intrusion detection systems
Spathoulas, G. P., & Katsikas, S. K. (2009) · Computers & Security · doi:10.1016/j.cose.2009.07.008 · Cited by 121 · see citing works
Data mining and machine learning—Towards reducing false positives in intrusion detection
Pietraszek, T., & Tanner, A. (2005) · Information Security Technical Report · doi:10.1016/j.istr.2005.07.001 · Cited by 120 · see citing works
The Power Mean and the Logarithmic Mean
Lin, T. (1974) · American Mathematical Monthly · doi:10.2307/2319447 · Cited by 103 · see citing works
Knowledge-based intrusion detection
Lunt, T. F., Jagannathan, R., Lee, R., Whitehurst, A., & Listgarten, S. (2003) · Annual AI Systems in Government Conference · doi:10.1109/aisig.1989.47311 · Cited by 69 · see citing works
On Efficient Learning Machine With Root-Power Mean Neuron in Complex Domain
Tripathi, B. K., & Kalra, P. K. (2011) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2011.2115251 · Cited by 60 · see citing works
TRINETR: an intrusion detection alert management systems
Yu, J., Reddy, Y. V. R., Selliah, S., Kankanahalli, S., Reddy, S., & Bharadwaj, V. (2005) · IEEE International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE) · doi:10.1109/enabl.2004.76 · Cited by 29 · see citing works
Using Contextual Information for IDS Alarm Classification (Extended Abstract)
Gagnon, F., Massicotte, F., & Esfandiari, B. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-02918-9_9 · Cited by 15 · see citing works
Using Contextual Information for IDS Alarm Classification
Esfandiari, B., Gagnon, F., & Massicotte, F. (2009) · Technische Universität Dortmund Eldorado (Technische Universität Dortmund) · doi:10.17877/de290r-2076 · Cited by 12 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A feature selection algorithm for intrusion detection system based on Pigeon Inspired Optimizer
Alazzam, H., Sharieh, A., & Sabri, K. E. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113249 · Cited by 399 · see citing works
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
“The method in question is referred to as the expert system approach and requires constructing a comprehensive knowledge base that accurately represents the traffic pattern [91].”
MethodHachmi, F., Boujenfa, K., & Limam, M. (2018) · Journal of Network and Systems Management · doi:10.1007/s10922-018-9459-y · Cited by 26 · see citing works
“A new system, which uses background information about hosts available in the network to generate a score for each alarm, is proposed in [11].”
BackgroundMethodUsing Pattern-of-Life as Contextual Information for Anomaly-Based Intrusion Detection Systems
Aparicio‐Navarro, F. J., Kyriakopoulos, K. G., Gong, Y., Parish, D. J., & Chambers, J. A. (2017) · IEEE Access · doi:10.1109/access.2017.2762162 · Cited by 25 · see citing works
“In [9], the authors proposed an IDS that relies on contextual information to classify the alerts as relevant or irrelevant.”
BackgroundDey, A. K., Gupta, G. P., & Sahu, S. P. (2024) · Cluster Computing · doi:10.1007/s10586-024-04422-6 · Cited by 14 · see citing works
“Following is a set of weight values: 25, since sf , ACC norm , F PR , DR norm are equally important to avoid any impact [40] and sum of weights should be 1 [12] [32] [39].”
Using the pattern-of-life in networks to improve the effectiveness of intrusion detection systems
Aparicio‐Navarro, F. J., Chambers, J. A., Kyriakopoulos, K. G., Gong, Y., & Parish, D. J. (2017) · International Conference on Communications · doi:10.1109/icc.2017.7997374 · Cited by 12 · see citing works
“In [6], the authors proposed an IDS that relies on contextual information to classify the alerts as relevant or irrelevant.”
BackgroundLin, Y., Lai, Y., Ho, C., & Tai, W.-H. (2013) · Computers & Security · doi:10.1016/j.cose.2013.09.010 · Cited by 12 · see citing works
“, 2012) Decision support Multiple Reduce FPs High overheads (Gupta et al., 2012) Knowledge-based evaluation One Reduce FPs High overheads (Chen et al.”
BackgroundMethodInfluentialAdding contextual information to Intrusion Detection Systems using Fuzzy Cognitive Maps
Aparicio‐Navarro, F. J., Kyriakopoulos, K. G., Parish, D. J., & Chambers, J. A. (2016) · IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support · doi:10.1109/cogsima.2016.7497807 · Cited by 10 · see citing works
“In [6], the authors propose an IDS that relies on contextual information to classify the alerts as relevant or irrelevant.”
BackgroundAnomaly-based network IDS false alarm filter using cluster-based alarm classification approach
Qassim, Q. S., Zın, A. M., & Aziz, M. J. A. (2016) · International Journal of Security and Networks · doi:10.1504/ijsn.2017.081056 · Cited by 8 · see citing works
An Efficient Cyber Assault Detection System using Feature Optimization for IoT-based Cyberspace
Dey, A. K., Gupta, G. P., & Sahu, S. P. (2024) · Procedia Computer Science · doi:10.1016/j.procs.2024.04.072 · Cited by 6 · see citing works
A test of intrusion alert filtering based on network information
Sommestad, T., & Franke, U. (2015) · Security and Communication Networks · doi:10.1002/sec.1173 · Cited by 6 · see citing works
“In the basic case only alerts that match a vulnerability known to be present in the targeted system is allowed through the filter ([11] [12] [13] [14] [7] [6] [15] [9]).”
BackgroundEnhancing Cybersecurity through Bayesian Node Profiling and Attack Classification
Desai, P. (2024) · International Journal of Wireless and Microwave Technologies · doi:10.5815/ijwmt.2024.01.04 · Cited by 4 · see citing works
IDS Alert Priority Determination Based on Traffic Behavior
Hiruta, S., Ikeda, S., Shima, S., & Takakura, H. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26834-3_11 · Cited by 4 · see citing works
Hachmi, F., Boujenfa, K., & Limam, M. (2015) · doi:10.1109/cit/iucc/dasc/picom.2015.264 · Cited by 3 · see citing works
“Then, based on the value of score threshold, a binary classifier groups the alert as real attacks or FPs. [39] proposed a correlation framework (CF) that reduces the number of processed alerts in the first phases by removing the inconsistent and false alerts.”
BackgroundA Streaming Intrusion Monitoring and Classification System for IaaS Cloud
Nikolai, J., & Wang, Y. (2016) · IEEE ... International Conference on Cloud Computing · doi:10.1109/cloud.2016.0089 · Cited by 2 · see citing works
“The effectiveness is demonstrated using contextual information as a basis of IDS alert classification [16].”
MethodNetwork IDS Duplicate Alarm Reduction Using Improved SNM Algorithm
Lu, X., Du, X., & Wang, W. (2018) · International Conference on Image, Vision and Computing (ICIVC) · doi:10.1109/icivc.2018.8492846 · Cited by 2 · see citing works
“Gupta [8] used background information about the hosts present on the network and the vulnerability exploited to generate a score for each alert.”
MethodHachmi, F., & Limam, M. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26832-3_13 · Cited by 1 · see citing works
Alert verification through alert correlation—An empirical test of SnIPS
Sommestad, T., & Holm, H. (2017) · Information Security Journal A Global Perspective · doi:10.1080/19393555.2016.1272727 · Cited by 1 · see citing works
“Other ideas use static information to prioritize alerts based on the potential impact of the vulnerability (Gupta et al., 2012) or asses if potential attackers have the connectivity required to exploit the known vulnerabilities (Meng & Li, 2012)(Haukeli, 2012)(Xiao & Xiao, 2007).”
BackgroundMethodA SVM-based IDS Alarms Filtering Method
Liu, Y., Xia, K.-P., & Zhao, J. (2014) · International Journal of Security and Its Applications · doi:10.14257/ijsia.2014.8.5.21 · Cited by 1 · see citing works
“ij ti tj t= r = x x , i j = , , , p n 、 (3-9)”
Literature Review about Performance Enhancement on Snort Intrusion Detection System
Shah, A., & Patel, U. V. (2015) · IJSRD : international journal for scientific research and development
- Authors
- Gupta, D., Joshi, P. S., Bhattacharjee, A. K., & Mundada, R. S.
- Affiliations
- Homi Bhabha National Institute (IN)
- Bhabha Atomic Research Centre (IN)
- ORCID
- Joshi, P.S.
- Venue
- 2012 Fourth International Conference on Communication Systems and Networks (COMSNETS 2012)
- Publisher
- IEEE
- Published
- 2012-01
- Pages
- 1-8
- OpenAlex
- W2019454925
- Cited by
- 20
- References
- 21
- Citations by year
- 2024: 3 · 2023: 1 · 2020: 1 · 2019: 1 · 2018: 2 · 2017: 3 · 2016: 3 · 2015: 4 · 2014: 1 · 2013: 1
- FWCI
- 1.61
- Type
- conference paper
- Language
- en
- Open access
- closed
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- intrusion detection systems, false positive alerts, alert prioritization, vulnerability exploitation, security analyst workload, pike
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
