Enhancing False Alarm Reduction Using Voted Ensemble Selection in Intrusion Detection

Abstract

Network intrusion detection systems (NIDSs) have become an indispensable component for the current network security infrastructure. However, a large number of alarms especially false alarms are a big problem for these systems which greatly lowers the effectiveness of NIDSs and causes heavier analysis workload. To address this problem, a lot of intelligent methods (e.g., machine learning algorithms) have been proposed to reduce the number of false alarms, but it is hard to determine which one is the best. We argue that the performance of different machine learning algorithms is very fluctuant with regard to distinct contexts (e.g., training data). In this paper, we propose an architecture of intelligent false alarm filter by employing a method of voted ensemble selection aiming to maintain the accuracy of false alarm reduction. In particular, there are four components in the architecture: data standardization, data storage, voted ensemble selection and alarm filtration. In the experiment, we conduct a study involved three machine learning algorithms such as support vector machine, decision tree and k-nearest neighbor, and use Snort, which is an open source signature-based NIDS, to explore the effectiveness of our proposed architecture. The experimental results show that our intelligent false alarm filter is effective and encouraging to maintain the performance of reducing false alarms at a high and stable level.

Outlier detection from vehicle trajectories to discover roaming events

“…Moreover, incorporation of post-processing algorithms (false alarm filter) as proposed in Refs. [26,27] will be considered to alleviate base-rate fallacy. Fourth, multi-level granular regions (geometric or semantic) will be utilized to alleviate location mismatch problem as mentioned above.…”

Developing a personal value analysis method of social media to support customer segmentation and business model innovation

“…The training samples were used to calculate the similarity with the data to be classified, and the accuracy of the method was obtained by using tenfold cross‐validation. This study used the classification algorithm of supervised learning, which is a learning model that is learned or built from the training data (Cuong, Dinh, & Ho, Meng & Kwok, ). This study used the Naïve Bayes, Bayes Net, KNN, J48, and LibSVM classification algorithms in the experimental stage.…”

Towards Bayesian-Based Trust Management for Insider Attacks in Healthcare Software-Defined Networks

“…In addition to the challenge-based trust mechanism, trust management of distributed IDS networks can be also built by using information theory [42] and game theory [44]. To further enhance the performance of an IDS, many optimization approaches have been designed in literature, such as alarm reduction [26], alarm verification [30], [31] and many filtration mechanisms (e.g., EFM [29]).…”