Data mining: practical machine learning tools and techniques with Java implementations
Data mining: practical machine learning tools and techniques with Java implementations
The 1999 DARPA off-line intrusion detection evaluation
Computer Networks: The International Journal of Computer and Telecommunications Networking - Special issue on recent advances in intrusion detection systems
A framework for constructing features and models for intrusion detection systems
ACM Transactions on Information and System Security (TISSEC)
Experience with EMERALD to Date
Proceedings of the Workshop on Intrusion Detection and Network Monitoring
Classification of intrusion detection alerts using abstaining classifiers
Intelligent Data Analysis
An intelligent network-warning model with strong survivability
CANS'07 Proceedings of the 6th international conference on Cryptology and network security
| Hi-index | 0.01 |
To solve the contradiction between the trend of more distributed network architecture and the demanding for more centralized correlated analysis to detect more complicated attacks from Intrusion Detection System (IDS), we first proposed in this paper an IDS architecture framework, which could collect relevant detected alert data from distributed diverse IDSes into one or more centralized point(s), and then efficient correlation analysis would be processed on shared data, after that, the meaningful and supportive knowledge rules from analysis results were be generated and automatically pushed back to each subscribed local IDS on scheduled time or even in real time, so that local IDS could utilize these rules to analyze new coming traffic. We also defined the XML format for those knowledge rule information generated by our hacking behavior correlation algorithms. We then presented seven mathematical algorithms on correlated hacking behavior analysis. In order for local IDS to effectively measure the false positive possibility of a new coming alert, we introduced three different approaches using some data mining and statistic models, including 1-Rule, Bagging Method and Native Bayer Method. By applying these methods to utilize and analyze the collected correlated knowledge rules, we could derive quite good quality of true attack confidence value for each coming detected alert. We also developed a simulation program implementing all these correlation algorithms and all those data mining and statistic models. We simply tested these algorithms with MIT Lincoln Lab's 1999 IDS evaluation data, and concluded that by utilizing these preliminary results, local IDS subscribed to this framework could derive a certain measurement of how confident an alarm is true attack in real time manner and even lower false positive rate if certain threshold applied.