Home   >   CSC-OpenAccess Library   >    Manuscript Information
Managing Intrusion Detection Alerts Using Support Vector Machines
Majid Ghonji Feshki, Omid Sojoodi, Minoo Deljavan Anvary
Pages - 266 - 273     |    Revised - 30-09-2015     |    Published - 31-10-2015
Volume - 9   Issue - 5    |    Publication Date - September / October 2015  Table of Contents
MORE INFORMATION
KEYWORDS
Intrusion Detection System, Alert Management, Support Vector Machine, Security Alert Classification, Reduction of False Positive Alerts, Classifying True Positive Alert Based on Their Attack types.
ABSTRACT
In the computer network world Intrusion detection systems (IDS) are used to identify attacks against computer systems. They produce security alerts when an attack is done by an intruder. Since IDSs generate high amount of security alerts, analyzing them are time consuming and error prone. To solve this problem IDS alert management techniques are introduced. They manage generated alerts and handle true positive and false positive alerts. In this paper a new alert management system is presented. It uses support vector machine (SVM) as a core component of the system that classify generated alerts. The proposed algorithm achieves high accurate result in false positives reduction and identifying type of true positives. Because of low classification time per each alert, the system also could be used in active alert management systems.
1 Google Scholar 
2 CiteSeerX 
3 refSeek 
4 TechRepublic 
5 Scribd 
6 SlideShare 
7 PdfSR 
Ahrabi, A.A.A., et al., A New System for Clustering and Classification of Intrusion Detection System Alerts Using Self-Organizing Maps. International Journal of Computer Science and Security (IJCSS), 2011. 4(6): p. 589.
Ahrabi, A.A.A., et al., Using Learning Vector Quantization in IDS Alert Management System. International Journal of Computer Science and Security (IJCSS), 2012. 6(2): p. 17.
Bahrbegi, H., et al. A new system to evaluate GA-based clustering algorithms in Intrusion Detection alert management system. 2010. IEEE.
Brugger, S.T. and J. Chow, An Assessment of the DARPA IDS Evaluation Dataset Using Snort, D. UC Davis Technical Report CSE-2007-1, CA, Editor. 2007.
Cortes, C. and V. Vapnik, Support-vector networks. Machine learning, 1995. 20(3): p. 273297.
Cuppens, F. Managing alerts in a multi-intrusion detection environment. 2001.
DARPA 1998 Intrusion Detection Evaluation Datasets, M.L. Lab., Editor. 1998.
DARPA 1998 Intrusion Detection Evaluation Datasets, M.L. Lab., Editor. 2000.
DARPA 2000 Intrusion Detection Evaluation Datasets, M.L. Lab., Editor. 2000.
Debar, H. and A. Wespi. Aggregation and Correlation of Intrusion-Detection Alerts. in Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection. 2001.
Debar, H., M. Dacier, and A. Wespi, Towards a taxonomy of intrusion-detection systems. Computer Networks, 1999. 31(8): p. 805-822.
Di Nuovo, A.G., V. Catania, and M. Palesi. The hybrid genetic fuzzy C-means: a reasoned implementation. in International Conference on Fuzzy Systems. 2006. World Scientific and Engineering Academy and Society (WSEAS).
Fuyan, L., C. Chouyong, and L. Shaoyi. An improved genetic approach. 2005. IEEE.
Julisch, K., Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security (TISSEC), 2003. 6(4): p. 443-471.
Kohonen, T., Learning vector quantization, in M.A. Arbib (ed.), The Handbook of Brain Theory and Beural Networks. 1995: MIT Press.
Kohonen, T., Self-Organized Maps. 1997, Science Berlin Heidelberg: Springer series in information.
Krishna, K. and M. Narasimha Murty, Genetic K-means algorithm. Systems, Man, and Cybernetics, Part B: Cybernetics, IEEE Transactions on, 1999. 29(3): p. 433-439.
Krovi, R. Genetic algorithms for clustering: a preliminary investigation. 1992. IEEE.
Lu, Y., et al. FGKA: a fast genetic K-means clustering algorithm. 2004. ACM.
Ma, J., Y. Zhao, and S. Ahalt, OSU SVM classifier matlab toolbox (ver 3.00). Pulsed Neural Networks, 2002.
Maheyzah, S.Z., Intelligent alert clustering model for network intrusion analysis. Journal in Advances Soft Computing and Its Applications (IJSCA), 2009. 1(1): p. 33-48.
Matlab, www.mathworks.com/products/matlab/, Editor. 2009, Mathworks.
MIRADOR, E. Mirador: a cooperative approach of IDS. in European Symposium on Research in Computer Security (ESORICS). 2000. Toulouse, France.
Njogu, H.W., et al., A comprehensive vulnerability based alert management approach for large networks. Future Generation Computer Systems, 2013. 29(1): p. 27-45.
Vapnik, V.N., The nature of statistical learning theory. 2000: Springer-Verlag New York Inc.
Wang, J., H. Wang, and G. Zhao. A GA-based Solution to an NP-hard Problem of Clustering Security Events. 2006. IEEE.
Webb, A.R., Statistical pattern recognition. Second Edition ed. 2002, Malvern UK: Wiley.
Mr. Majid Ghonji Feshki
Department of computer science Islamic Azad University, Qazvin Branch Qazvin, Qazvin, Iran - Iran
ghonji.majid@yahoo.com
Dr. Omid Sojoodi
Department of computer science, Islamic Azad University, Qazvin Branch - Iran
Mr. Minoo Deljavan Anvary
IT Department School of e-Learning Shiraz University Shiraz, Fars, Iran - Iran


CREATE AUTHOR ACCOUNT
 
LAUNCH YOUR SPECIAL ISSUE
View all special issues >>
 
PUBLICATION VIDEOS