Using Neuro-Fuzzy Approach to Reduce False Positive Alerts

Authors:
Riyad Alshammari;Sumalee Sonamthiang;Mohsen Teimouri;Denis Riordan
Affiliations:
Dalhousie University, Canada;Dalhousie University, Canada;Dalhousie University, Canada;Dalhousie University, Canada
Venue:
CNSR '07 Proceedings of the Fifth Annual Conference on Communication Networks and Services Research
Year:
2007

Citing 0
Cited 2

The Problem of False Alarms: Evaluation with Snort and DARPA 1999 Dataset

TrustBus '08 Proceedings of the 5th international conference on Trust, Privacy and Security in Digital Business
Review: The use of computational intelligence in intrusion detection systems: A review

Applied Soft Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

One of the major problems of Intrusion Detection Systems (IDS) at the present is the high rate of false alerts that the systems produce. These alerts cause problems to human analysts to repeatedly and intensively analyze the false alerts to initiate appropriate actions. We demonstrate the advantages of using a hybrid neuro-fuzzy approach to reduce the number of false alarms. The neuro-fuzzy approach was experimented with different background knowledge sets in DARPA 1999 network traffic dataset. The approach was evaluated and compared with RIPPER algorithm. The results shows that the neurofuzzy approach significantly reduces the number of false alarms more than the RIPPER algorithm and requires less background knowledge sets.