A Comprehensive Approach to Improving Information Quality of IDS Alerts
Chengpo Mu · International Conference on Electric Information and Control Engineering · 2012
A comprehensive approach that integrates a few different techniques, including alert confidence learning, alert verification, alert correlation and online risk assessment, is proposed to improve the information quality of IDS alerts. These techniques complement each other and lead to better results than using any single technique for reducing false alerts, irrelevant alerts and duplicate alerts in an IDS system. The result of the comprehensive approach gives a clear picture of both an intrusion progress and a target security state and it provides more information of higher quality about the threat of the intrusion than raw alerts. This comprehensive approach severs as the foundation for intrusion response decision-making and can be used to integrate different kinds of security tools for cooperative defense of network systems.