False Alarm Reduction by Weighted Score-Based Rule Adaptation through Expert Feedback
Hui-Hsuan Lin, Ching-Hao Mao, Hahn-Ming Lee · 2009
An adaptation mechanism is quite important for false alarm reduction in Intrusion Detection System (IDS) for solving the problem of environment change and wrongly trigger from irrelevant signatures. In this study, we proposed a Weighted Score-based Rule Adaptation (WSRA) mechanism from expert’s feedback in order to reduce the massive false alarm produced by IDS. The rule set is generated by rule learner (e.g.: RIPPER) to identify the false alert in addition to a score which represents its availability. The weighted score-based rule adaptation adjusts the score according to the incoming labeled information from expert. Besides, we also propose the concept level features to the false alarm reduction issues for easily retrieving the feedback from experts. We propose WSRA, which makes following contributions: (a) it automatically adapts with the network environment changes to identify false alarms, (b) it proposes a new weighted score-based rule adaptation mechanism, (c) it is easier to demonstrate the rules for retrieving experts feedback benefits from concept level features. The evaluations from one benchmark dataset (DARPA 99) support our approach. The proposed mechanism performs well in false alarm reduction than that other down by mechanism without adaptation consideration.