Reduction of false positives in intrusion detection via adaptive alert classifier
Zhihong Tian, Weizhe Zhang, Jianwei Ye, Xiangzhan Yu, Hongli Zhang · 2008
An important problem in the field of intrusion detection is the management of alerts. Intrusion detection systems tend to overwhelmed human operators with a large volume of false positives. In order to correctly identify the alerts related to attacks and reduce false positives, this paper describes a novel adaptive alert classifier based on pattern mining method. The alert classifier supports the operators by classifying alerts into true positives and false positives and learns knowledge adaptively by the feedback of the operators. The results of experiment show that the alert classifier is able to reduce the numerous redundant alerts and effectively reduces the analyst operators’ workload.