Using neuro-fuzzy approach to reduce false positive alerts

Proceedings - CNSR 2007: Fifth Annual Conference on Communication Networks and Services Research

Volumn , Issue , 2007, Pages 345-349

  Alshammari, Riyad ^a   Sonamthiang, Sumalee ^a   Teimouri, Mohsen ^a   Riordan, Denis ^a  

^a DALHOUSIE UNIVERSITY   (Canada)

Author keywords

Classification; False positive; Intrusion detection; Neuro fuzzy; Security

Indexed keywords

ALGORITHMS; CLASSIFICATION (OF INFORMATION); FUZZY NEURAL NETWORKS; NETWORK SECURITY; TELECOMMUNICATION TRAFFIC;

FALSE POSITIVE ALERTS; INTRUSION DETECTION SYSTEMS (IDS); NETWORK TRAFFIC DATASETS;

INTRUSION DETECTION;

EID: 34548321528     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CNSR.2007.70     Document Type: Conference Paper

References (19)

1. Pietraszek, T., "Using Adaptive Alert Classification to Reduce False Positives in Intrusion Detection," Recent Advances in Intrusion Detection: 7th International Symposium RAID 2004, pp. 102-124, September 2004.
2. Cohen, W.W., "Fast effective rule induction," In Machine Learning: Proceedings of the Twelfth International Conference, pp. 115-123. 1995.
3. Roesch, M., "Snort lightweight intrusion detection for networks," The 13th USENIX Systems Administration Conference (USA 99), pp. 228-238. November 1999. Available http://www.snort.org. Accessed August 2006.
4. Turner, A., "Tcpreplay," http://tcpreplay.synfin.net/ trac/. Accessed August 2006.
5. Witten, Ian H., Frank, E. Data Mining: Practical Machine Learning Tools and Techniques with Java Implementations,Morgan Kaufmann Publishers, 2000.
6. Lincoln Laboratory Massachusetts Institute of Technology. DARPA intrusion detection evaluation. http://www.ll.mit.edu/IST/ideval/docs/1999/schedule.html. Accessed August 2006.
7. Axelsson, S., "The base-rate fallacy and the difficulty of intrusion detection," ACM Trans Inf. Syst. Secur., Vol.3, No. 3, pp. 186-205, August 2000.
8. Portnoy, L., Eskin E., and Solfo S., "Intrusion detection with unlabelled data using clustering," Proceedings of ACM CSS Workshop on Data Mining Applied to Security (DMSA-2001), pp. 76-105, 2001.
9. Mahoney, M. and Chan, P., "An analysis of the 1999 DARPA Lincoln Laboratory evaluation data for network anomaly detection," In Recent Advances in Intrusion Detection (RAID2003)- Lecture Notes in Computer Science, Vol. 2820, pp. 220-237. Springer-Verlag, 2003.
10. Debar, H. and Wespi, A., "Aggregation and correlation of intrusion-detection alerts," Recent Advances in Intrusion Detection(RAID2001) - Lecture Notes in Computer Science, Vol. 2212, pp. 85-103. Springer-Verlag, 2001.
11. Wang, J. and Lee, I., "Measuring false-positive by automated realtime correlated hacking behavior analysis," Information Security 4th International Conference ?Lecture Notes in Computer Science, Vol. 2200, pp. 512. Springer-Verlag, 2001.
12. Nauck, D. and Kruse, R., "NEFCLASS: A Neuro-Fuzzy Approach for the Classification of Data," In K M. George, J. H. Carrol, E. Deaton, D. Oppenheim, and J. High- tower, editors, Applied Computing 1995. Proe. 1995 ACM Symposium on Applied Computing, Nashville, Feb. 26-28, pages 461-465. ACM Press, New York, Feb. 1995.
13. Nanck, D. and Kruse, R., "A neuro-fuzzy method to learn fuzzy classification rules from data," Fuzzy Sets and Systems, Vol.89, pp. 277-288, 1997.
14. Bakar, N. A., Belaton, B. and Samsudin A., "False Positives Reduction via Intrusion Alert Quality Framework," Joint IEEE Malaysia International Conference on Communications and IEEE International Conference on Networks, pp. 547-552, November 2005.
15. Nauck, D., "Neuro-Fuzzy Systems: Review and Prospects," Proceedings of Fifth European Congress on Intelligent Techniques and Soft Computing (EUFIT97), pp. 1044-1053, 1997.
16. Abraham, A., "Beyond Neuro-Fuzzy Systems: Reviews, Prospects," Seventh International Mendel Conference on Soft Computing, Brno, MENDEL 2001, Matousek Radek et al (Eds.), pp. 376-372, 2001.
17. Schuba C. L., et. al. "Analysis of a denial of service attack on TCP," Proceedings of 1997 IEEE Symposium on Security and Privacy, pp. 208-223, IEEE Computer Society Press, 1997.
18. Jantzen, J., "Neurofuzzy modelling" Technical Report No. 98-H-874 (nfmod), Technical University of Denmark, Department of Automation, October 1998.
19. Nauck, D., Nauck, U. and Kruse, R., "NEFCLASS for JAVA - New Learning Algorithms," Proceddings of Fuzzy Information Processing Society (NAFIPS) ?18th International Conference of the North American, pp. 472-476. July 1999.