Alert classification to reduce false positives in intrusion detection.
Tadeusz Pietraszek · FreiDok plus (Universitätsbibliothek Freiburg) · 2006
Intrusion Detection Systems (IDSs) aim at detecting intrusions, that is actions that attempt to compromise the confidentiality, integrity and availability of computer resources. With the proliferation of the Internet and the increase in the number of networked computers, coupled with the surge of unauthorized activities, IDSs have become an integral part of today's security infrastructures. However, in real environments IDSs have been observed to trigger an abundance of alerts. Most of them are false positives, i.e., alerts not related to security incidents. This dissertation deals with the problem of false positives inintrusion detection. We propose the novel concept of training an alert classifier using a human analyst's feedback and show how to build an efficient alert classifier using machine-learning techniques. We analyze the desired properties of such a system from the domain perspective and introduce ALAC, an Adaptive Learner for Alert Classification, and its two modes of operation: a recommender mode, in which all alerts with their classification are forwarded to the analyst, and an agent mode, in which the systemuses autonomous alert processing. We evaluate ALAC in both modes on real and synthetic intrusion detection datasets and obtain promising results: In our experiments ALAC reduced the number of false positives by up to 60% with acceptable misclassification rates. Abstaining classifiers are classifiers that in certain cases can refrain from classification, which is similar to a domain expert saying "I don't know". Abstaining classifiers are advantageous over normal classifiers if they perform better than normal classifiers when they make a decision. In this dissertation we provide a clarification of the concept of optimal abstaining classifiers and introduce three different models, in which normal and abstaining classifiers can be compared: the cost-based model, the bounded-abstention model, and the bounded-improvement model. In the first cost-based model, the classifier uses an extended 2x3 cost matrix, whereas in the bounded models, the classifier uses a standard 2x2 cost matrix and boundary conditions: the abstention window or the desired cost improvement. Looking at a common type of abstaining classifiers, namely classifiers constructed from a single ROC curve, we provide efficient algorithms for selecting these classifiers optimally in each of these models. We perform an experimental validation of these methods on a variety of common benchmark datasets. Applying abstaining classifiers to ALAC, we introduce ALAC+, an extension of our alert-classification system. We select the most suitable abstaining classifier models and show that by using abstaining classifiers one can significantly reduce the misclassification cost. For example, in our experiments with a 10% abstention the system reduced the overall misclassification cost by up to 87%. This makes abstaining classifiers particularly suitable for alert classification. In the final part of this dissertation, we extend CLARAty, the state-of-the-art alert clustering system by introducing automated cluster processing, and show how the system can be used to investigate missed intrusions and correct initial analyst's classifications. Based on this, we build a two-stage alert-classification system in which alerts are processed by the automated cluster-processing system and then forwarded to ALAC. Our experiments with real and synthetic datasets showed that the automated cluster-processing system is robust and on average reduces the total number of alerts by 63% which further reduces the analyst's workload.