IDS Alert Classification Model Construction Using Decision Support Techniques
Yan Zhang, Shuguang Huang, Yongyi Wang · 2012
Although many IDSs have been proposed to assist administrators in detecting intrusion, false alarms are still huge and result in the difficulty of analysis. For this reason, we proposed a decision support system for constructing an alert classification model, which consists of three phases: alert preprocessing, model constructing and rule refining. Experimental results show that the proposed method discovers intrusion patterns quickly and precisely, and lightens the load of on-line alert analysis for experts obviously.