Reducing false positive and false negative by correlation and risk assessment
Li Ding · Jisuanji yingyong yanjiu · 2008
The main problems facing intrusion detection systems are high false positive rate and false negative rate.This paper proposed a correlation and risk assessment approach to solve these problems,which exploited constructed security correlation model to compute real-time risk for every security event(such as alert,operating system log record,and so on),and gave out new alerts for high risk events while discard low risk ones so as to reduce false positive and false negative rate.The initial test results of event correlation system show that this approach dramatically reduces the rate of false positive and false negative rate of intrusion detection systems.