NDLI: Using Attack Information to Reduce False Positives in Network IDS

Content Provider	IEEE Xplore Digital Library
Author	Shimamura, M. Kono, K.
Copyright Year	2006
Description	Author affiliation: Keio University, Japan (Shimamura, M.)
Abstract	Reducing the rate of false positives is of vital importance in enhancing the usefulness of signature-based network intrusion detection systems (NIDSs). To reduce false positives, a network administrator must throughly investigate a lengthy list of signatures and carefully disable the ones that detect attacks not harmful to the user’s environment. This is a daunting task; if some signatures are disabled by mistake, the NIDS fails to detect critical remote attacks. We designed a NIDS, TrueAlarm, to reduce the rate of false positives. Conventional NIDSs alert administrators to the detection of a malicious message, regardless of whether the message actually attempts to compromise the protected server. In contrast, TrueAlarm delays the alert until it confirms that an attempt has been made. In TrueAlarm, NIDS cooperates with a server-side monitor that observes the protected server’s behavior. TrueAlarm alerts administrators only when a server-side monitor detects deviant server behavior that must have been caused by a message detected by NIDS. Our experimental results show that TrueAlarm reduces the rate of false positives. Using real network traffic collected over 15 days, TrueAlarm produced no false positives, while a conventional NIDS produced 125.
Starting Page	386
Ending Page	393
File Size	219040
Page Count	8
File Format	PDF
ISBN	0769525881
ISSN	15301346
DOI	10.1109/ISCC.2006.165
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2006-06-26
Publisher Place	Italy
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intelligent networks Intrusion detection Telecommunication traffic Protection Monitoring Delay Computer science Network servers Pattern matching
Content Type	Text
Resource Type	Article
Subject	Signal Processing Mathematics Computer Networks and Communications Computer Science Applications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Environmental awareness intrusion detection and prevention system toward reducing false positives and false negatives

Adaptive IDS Alerts Correlation according to the traffic type and the attacks properties

Experimental Validation of An Intelligent Detection and Response Strategy for Complex Infrastructure Attacks and False Positives Using Firewalls

Enhanced automated intrusion prevention in network security

Changing Network Behavior

Statistical analysis of false positives and false negatives from real traffic with intrusion detection/prevention systems

An intelligent detection and response strategy to false positives and network attacks: operation of network quarantine channels and feedback methods to IDS

Training MLP neural network to reduce false alerts in IDS

Network Intrusion Detection Systems in High-Speed Traffic in Computer Networks

Using Attack Information to Reduce False Positives in Network IDS

Similar Documents

Environmental awareness intrusion detection and prevention system toward reducing false positives and false negatives

Adaptive IDS Alerts Correlation according to the traffic type and the attacks properties

Experimental Validation of An Intelligent Detection and Response Strategy for Complex Infrastructure Attacks and False Positives Using Firewalls

Enhanced automated intrusion prevention in network security

Changing Network Behavior

Statistical analysis of false positives and false negatives from real traffic with intrusion detection/prevention systems

An intelligent detection and response strategy to false positives and network attacks: operation of network quarantine channels and feedback methods to IDS

Training MLP neural network to reduce false alerts in IDS

Network Intrusion Detection Systems in High-Speed Traffic in Computer Networks

Using Attack Information to Reduce False Positives in Network IDS