A Semi-Supervised IDS Alert Classification Model Based on Alert Context
Haibin Mei, Minghua Zhang · Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013) · 2013
How to filtering false positives is a fundamental problem of IDS.Constructing alert classification model is one of efficient methods.However, the high cost of preparing training data and classification feature selection are key points in the problem.This paper gives a semi-supervised alert classification model which makes use of the power of semisupervised learning.Moreover, four classification features about alert context are introduced to improve classification accuracy.Experiments conducted on the DARPA 1999 dataset show that the use of the alert context properties can increase the classification accuracy by about 3 percent.