Hybrid Rule Threshold Adjustment System for Intrusion Detection
Publish place: 08th Iranian Security Community Conference
Publish Year: 1390
نوع سند: مقاله کنفرانسی
زبان: English
View: 1,719
This Paper With 8 Page And PDF Format Ready To Download
- Certificate
- من نویسنده این مقاله هستم
استخراج به نرم افزارهای پژوهشی:
شناسه ملی سند علمی:
ISCC08_039
تاریخ نمایه سازی: 11 مهر 1390
Abstract:
Generally, multiple IDSs generates huge volume of alerts every minute and to manage these alerts, rule-based alert management systems are very important. It is critical to keep the rules inside these systems updated, based on the ever changing network environment. Rule Threshold Adjustment is the solution to this problem and it is able to keep the rules updated. Rule Threshold Adjustment tunes the internal thresholds and keeps the structure unchanged. In this paper, we propose a hybrid threshold Adjustment framework by combining both the online and offline adjustment module together. This hybrid adjustment will be more robust and efficient in adjustment the threshold in real time and to keep the threshold fine-adjusted. The online module should work in real time to adjust the thresholds, whereas the offline module will be using some parts of the recent alerts to adjust the thresholds. We have implemented this method and evaluated it using real-world datasets. Our approach was successfully able to adjust the rules in all the cases with marginal error.
Keywords:
Authors
Mohamad Mehdi Moghimi
Research Staff Sepehr S. T. Co. Ltd.Tehran, Iran
Mohamad Saraee
Assistant Professor, ECE Department Isfahan University of Technology(IUT)Isfahan, Iran