Reducing False Positives Based on Time Sequence Analysis
Dong Li, Zhitang Li, Li Wang · 2007
Various IDS devices produce large number of alert, the majority of which are false positives. It is laborious for the security officers to find real intrusions. To find intrusions in real time, we should first remove false positives in the alerts. According to the experience of IDS alerts analysis, we find that there are some regularities in alert flow occurrence: power law, trend, periodicity. Based on these statistical regularities, we can operate it based on time sequence effectively. The results of real world data analysis demonstrate that the method can reduce massive false positives in real time effectively.