Home   >   CSC-OpenAccess Library   >    Manuscript Information
Full Text Available

(133.15KB)
This is an Open Access publication published under CSC-OpenAccess Policy.
Efficient Security Alert Management System
Minoo Deljavan Anvary, Majid Ghonji Feshki, Amir Azimi Alasti Ahrabi
Pages - 218 - 224     |    Revised - 31-07-2015     |    Published - 31-08-2015
Volume - 9   Issue - 4    |    Publication Date - July / August 2015  Table of Contents
MORE INFORMATION
KEYWORDS
Intrusion Detection, Security Alert Management, K-nearest Neighbor, Real-time Security Alert Classification, Reduction of False Positive Alerts, Precise Classifying True Positive Alerts.
ABSTRACT
Nowadays there are several security tools that used to protect computer systems, computer networks, smart devices and etc. against attackers. Intrusion detection system is one of tools used to detect attacks. Intrusion Detection Systems produces large amount of alerts, security experts could not investigate important alerts, also many of that alerts are incorrect or false positives. Alert management systems are set of approaches that used to solve this problem. In this paper a new alert management system is presented. It uses K-nearest neighbor as a core component of the system that classify generated alerts. The suggested system serves precise results against huge amount of generated alerts. Because of low classification time per each alert, the system also could be used in online systems.
CITED BY (0)  
1 Google Scholar
2 CiteSeerX
3 refSeek
4 TechRepublic
5 Scribd
6 SlideShare
7 PdfSR
1 Debar, H., M. Dacier, and A. Wespi, Towards a taxonomy of intrusion-detection systems. Computer Networks, 1999. 31(8): p. 805-822.
2 Ahrabi, A.A.A., et al., A New System for Clustering and Classification of Intrusion Detection System Alerts Using Self-Organizing Maps. International Journal of Computer Science and Security (IJCSS), 2011. 4(6): p. 589.
3 Cover, T. and P. Hart, Nearest neighbor pattern classification. Information Theory, IEEE Transactions on, 1967. 13(1): p. 21-27.
4 Wang, J., H. Wang, and G. Zhao. A GA-based Solution to an NP-hard Problem of Clustering Security Events. 2006. IEEE.
5 Wang, J. and B. Cui. Clustering IDS Alarms with an IGA-based Approach. 2009. IEEE.
6 Julisch, K., Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security (TISSEC), 2003. 6(4): p. 443-471.
7 Maheyzah, S.Z., Intelligent alert clustering model for network intrusion analysis. Journal in Advances Soft Computing and Its Applications (IJSCA), 2009. 1(1): p. 33-48.
8 DARPA 2000 Intrusion Detection Evaluation Datasets, M.L. Lab., Editor. 2000.
9 Cuppens, F. Managing alerts in a multi-intrusion detection environment. 2001.
10 MIRADOR, E. Mirador: a cooperative approach of IDS. in European Symposium on Research in Computer Security (ESORICS). 2000. Toulouse, France.
11 Debar, H. and A. Wespi. Aggregation and Correlation of Intrusion-Detection Alerts. in Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection. 2001.
12 DARPA 1998 Intrusion Detection Evaluation Datasets, M.L. Lab., Editor. 1998.
13 Kohonen, T., Self-Organized Maps. 1997, Science Berlin Heidelberg: Springer series in information.
14 Bahrbegi, H., et al. A new system to evaluate GA-based clustering algorithms in Intrusion Detection alert management system. 2010. IEEE.
15 Ahrabi, A.A.A., et al., Using Learning Vector Quantization in IDS Alert Management System. International Journal of Computer Science and Security (IJCSS), 2012. 6(2): p. 1-7.
16 Kohonen, T., Learning vector quantization, in M.A. Arbib (ed.), The Handbook of Brain Theory and Beural Networks. 1995: MIT Press.
17 Snort, The open source network intrusion detection system. 2012.
18 Brugger, S.T. and J. Chow, An Assessment of the DARPA IDS Evaluation Dataset Using Snort, D. UC Davis Technical Report CSE-2007-1, CA, Editor. 2007.
19 Franc, V. and V. Hlavác. Statistical pattern recognition toolbox for Matlab. Center for Machine Perception, Czech Technical University 2004; Available.
20 Mathworks, MATLAB. 2014, http://www.mathworks.com.
Mr. Minoo Deljavan Anvary
IT Department School of e-Learning, Shiraz University, Shiraz, Fars. - Iran
Mr. Majid Ghonji Feshki
Department of Computer Science Qzvin Branch, Islamic Azad University Qazvin, Qazvin. - Iran
Mr. Amir Azimi Alasti Ahrabi
Industrial Management Institute - Iran
amir.azimi.alasti@gmail.com