TY - GEN
T1 - Alert prioritization in Intrusion Detection Systems
AU - Alsubhi, Khalid
AU - Al-Shaer, Ehab
AU - Boutaba, Raouf
PY - 2008
Y1 - 2008
N2 - Intrusion Detection Systems (IDSs) are designed to monitor user and/or network activity and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large; making the task of security analysts difficult to manage. Furthermore, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide imprecise results. In this paper, we propose a fuzzy-logic based technique for scoring and prioritizing alerts generated by an IDS(1). In addition, we present an alert rescoring technique that leads to a further reduction of the number of alerts. The approach is validated using the 2000 DARPA intrusion detection scenario specific datasets and comparative results between the Snort IDS alert scoring and our scoring and prioritization scheme are presented.
AB - Intrusion Detection Systems (IDSs) are designed to monitor user and/or network activity and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large; making the task of security analysts difficult to manage. Furthermore, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide imprecise results. In this paper, we propose a fuzzy-logic based technique for scoring and prioritizing alerts generated by an IDS(1). In addition, we present an alert rescoring technique that leads to a further reduction of the number of alerts. The approach is validated using the 2000 DARPA intrusion detection scenario specific datasets and comparative results between the Snort IDS alert scoring and our scoring and prioritization scheme are presented.
KW - Alert management
KW - Alert prioritization
UR - http://www.scopus.com/inward/record.url?scp=51849167357&partnerID=8YFLogxK
U2 - 10.1109/NOMS.2008.4575114
DO - 10.1109/NOMS.2008.4575114
M3 - Conference contribution
AN - SCOPUS:51849167357
SN - 9781424420667
T3 - NOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services
SP - 33
EP - 40
BT - NOMS 2008 - IEEE/IFIP Network Operations and Management Symposium
T2 - NOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services
Y2 - 7 April 2008 through 11 April 2008
ER -