An Intelligent Detection and Response Strategy to False Positives and Network Attacks

Authors:
Emmanuel Hooper
Affiliations:
University of London Royal Holloway, UK
Venue:
IWIA '06 Proceedings of the Fourth IEEE International Workshop on Information Assurance
Year:
2006

Citing 0
Cited 2

An Intelligent Intrusion Detection and Response System Using Network Quarantine Channels: Adaptive Policies and Alert Filters

WI-IATW '06 Proceedings of the 2006 IEEE/WIC/ACM international conference on Web Intelligence and Intelligent Agent Technology
Divided two-part adaptive intrusion detection system

Wireless Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Current Intrusion Detection Systems (IDSs) monitor attacks in network infrastructures by triggering alerts on potential security violations. However, most of these generate very high volumes of false positives, making the task of manually analyzing these alerts extremely difficult and inefficient. In this paper, we explain in detail why false positives occur giving real examples, and propose a novel approach for their reduction through intelligent Network Quarantine Channels (NQCs) technique. This examines the packets by sending intelligent responses to suspect hosts for further information. Subsequently, the NQC sends feedbacks to the IDS to modify the alerts and enhance its capability to detect threats and benign attacks. We propose multiple feedback methods, including messages and adaptive rules in alert filters and policies to the IDS monitor, network sensors and database. We describe in detail, a prototype implementation of the intelligent detection and response strategy to benign and attack packets.