Experts' Knowledge Merging to Reduce IDS Alerts Number
Lydia Bouzar-Benlabiod, Lila Méziani, Chebieb Abdelkrim, Rim Nacer-Eddine, Zakaria Mellal · 2016
Intrusion Detection Systems (IDS) are security tools that generate alerts when detecting a malicious activity. The main drawback of IDS is the high number of generated alerts. We propose an approach that integrates the knowledge of several security experts to improve IDS results and reduce the alerts number. The experts' knowledge are expressed in IFO (Instantiated First Order) logic. A new logical knowledge merging algorithm is given. This algorithm takes as input the different experts' knowledge bases and produce a unique knowledge base. The resulted knowledge base is used to filter the IDS alerts. We achieve tests on real IDS alerts.