Alert Prioritizing for IDS Alert Management System using Fuzzy Logic
Elnaz Safarzadeh, Hadi Bahrbegi, Amir Azimi Alasti Ahrabi · Medical Informatics · 2013
One of the most important tool in security field are Intrusion Detection Systems. The main purpose of IDS is to monitor suspicious network traffic and generate alerts. These systems are known to generate many alerts. Analyzing these alerts manually by security expert are time consuming, tedious and error prone. From another point of view false positive alerts have huge share of generated alerts. Identifying attack types and generating correct alerts related to attacks is another problem with IDS. In order to overcome mentioned problems alert management systems was introduced. Alert management systems help security experts to manage alerts and produce a high level view of alerts. In this paper a new alert prioritizing algorithm for IDS Alert Management System proposed that uses the fuzzy logic. The proposed algorithm ranks alerts and detects false positive alerts.