RAPID: Reputation based approach for improving intrusion detection effectiveness

Abstract

Reducing false positives have been one of the toughest challenges and a very practical problem in real life deployments of intrusion detection systems. It leads to decreased confidence in the IDS alerts. The security analyst is faced with the choice between disabling valuable signatures that also generate false positives on one hand, and missing true alerts among the flood of false positives on the other hand. In this paper we present an architecture that utilizes IP reputation along with signature levels in order to reduce false positives and thereby increase the effectiveness of the IDS. In the proposed approach the IDS signatures are classified and grouped into various levels based on their false positive rating, and the incoming traffic is analyzed by one or more of the signature levels based on the reputation of the IP addresses. We also discuss a prototype implementation of the proposed approach that is based on open source IDS -Snort. Evaluation showed promising results in reducing false positives and corresponding improvement in Bayesian detection rate for the prototype system as compared to Snort.

Towards Malware Detection via CPU Power Consumption: Data Collection Design and Analytics

“…Third, the unsupervised detection results display the quantitative gain in the false detection rate of the ensemble over any of the constituent members with no expense to the true positive rate. This shows that the ensemble directly addresses the base rate fallacy and supports a growing body of literature in this area [9], [10], [11], [12], [13], [14], [15], [16]. Finally, our anomaly detection ensemble outperforms the supervised algorithms-perhaps surprising given that the latter is privy to other known malware profiles during training.…”

IP Reputation Scoring with Geo-Contextual Feature Augmentation

“…A number of studies have proposed approaches for reputation scoring of IPs in computer networks. To deduce the reputation scores, features are compared against those of known signatures [Fukushima et al 2011;Thomas 2010;Antonakakis et al 2010;Renjan et al 2018]. For example, Renjan et al [2018] propose a vector space approach that uses Euclidean distance to compare features of an IP address to those of blacklisted IPs.…”

Improving the results of intrusion detection systems

“…The alert-set itself is also utilized in [29]. The method proposed therein is based on the calculation of reputation for alerts.…”