Design and analysis of the model of the alarms analysis system in NIDS
Yongzhi Bai · Journal of Hefei University of Technology · 2005
Nowadays many network intrusion detection systems(NIDSs) employ the misuse detection technology or the anomaly detection technology to detect network data streams and alarm attack attempts.In reality,too many alarms and the high false positive rate have already restricted the development of NIDSs.The causes are analyzed in this paper,and to solve the problems,a model based on anomaly detection is presented for analyzing the alarms in NIDSs.The application of database mining technology to extract the behavior of normal alarms of NIDSs is discussed in detail.