Platform Design and Implementation for Flexible Data Processing and Building ML Models of IDS Alerts
Iksoo Shin, Yunsoo Choi, Taewoong Kwon, Hyeak-Ro Lee, Jungsuk Song · 2019
Intrusion detection system(IDS) is one of the widely adapted security systems in the world. IDS can detect malicious activities on networks or hosts and raises alerts which should be analysed by security operators. But alerts generated from IDS are too huge to analyse all of them and most of the alerts are false positive. To mitigate this problem, many approaches have been carried out using machine learning. Machine learning(ML) is a promising technique because of its outstanding performance. But sometimes it is time and effort consuming work to make a good machine learning model. Because one should consider many options on the machine learning making process including feature, normalization and model. And there should be many repetitive experiments to find proper parameters of model. In this paper, we propose a machine learning platform for classification of IDS alerts as a way of solution about the time and effort consuming works. On the platform, researcher and engineers don't need to care about implementation and can focus only on better configurations for classification of IDS alerts. Repetitive works of data processing and building models will be carried out in an automated manner on the platform. As well, we expect that many security experts unfamiliar with machine learning technique can attempt to make machine learning models easily through the platform. With the participation of many security experts, various experiments could be carried out. And it could promote the transformation of their expertise into ideas for models through their feedback. This paper presents how we designed our platform and implemented the system until these days.