Application of singular spectrum analysis to the noise reduction of intrusion detection alarms

Journal of Computers

Volumn 6, Issue 8, 2011, Pages 1715-1722

  Ma, Jie ^a   Li, Zhi Tang ^a   Wang, Bing Bing ^a  

^a HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (China)

Author keywords

Alarm noise; Intrusion detection; SSA

Indexed keywords

ABNORMAL COMPONENTS; ALARM NOISE; BACKGROUND NOISE; DETECTION ALGORITHM; DETECTION APPROACH; EVALUATION RESULTS; FALSE ALARMS; INTRINSIC DIMENSIONS; INTRUSION DETECTION SYSTEMS; LABOR INTENSIVE; MANUAL ANALYSIS; MODEL ACCURACY; NONSTATIONARY; NORMAL COMPONENT; REAL NETWORKS; RESIDUAL COMPONENTS; SINGULAR SPECTRUM ANALYSIS; SSA; STATIONARY MODELS; SYSTEM BEHAVIORS;

ALARM SYSTEMS; ERRORS; INTERFEROMETRY; SPECTRUM ANALYSIS;

INTRUSION DETECTION;

EID: 80051622137     PISSN: 1796203X     EISSN: None     Source Type: Journal    
DOI: 10.4304/jcp.6.8.1715-1722     Document Type: Article

References (13)

1. J. Allen, A. Christie, et al., (2007) State of the Practice of Intrusion Detection Technologies. Available via Software Engineering Institute. http://www.sei.cmu.edu/publications/documents/99.reports/99tr028/99tr028abstract.html.
2. K. Julisch, Mining Alarm Clusters to Improve Alarm Handling Efficiency, in: Proceedings of the 17th Annual Conference on Computer Security Applications, pp. 12-21, 2001
3. J. Viinikka. Intrusion Detection Alert Flow Processing Using Time Series Analysis Methods. PhD thesis, University of Caen, Caen, France, November 2008
4. B. Caswell, M. Roesch (2004) Snort: The open source network intrusion detection system. Available via Snort. http://www.snort.org/
5. N. Nekrutkin, V. Zhigljavsky, 2001. Analysis of Time Series Structure-SSA and Related Techniques. Chapman & Hall/CRC, Boca Raton, FL, pp. 13-78.
6. I. T. Jolliffe, "Principal Component Analysis", Springer-Verlag, 1986.
7. V. G. Moskvina, A. Zhigljavsky, An algorithm based on singular spectrum analysis for change-point detection. Communications in Statistics -Simulation and Computation, 1532-4141, Volume 32, Issue 2, 2003, Pages 319-352
8. P. Ning, D. Reeves, Y. Cui, An Intrusion Alert Correlator Based on Prerequisites of Intrusions. Technical Report TR- 2002-01, North Carolina State University (2002)
9. W. Lee, S. J. Stolfo, A Framework for Constructing Features and Models for Intrusion Detection Systems, ACM Transactions on Information and System Security 3(4) (2000) 227-261
10. X. Qin and W. Lee. Statistical Causality Analysis of INFOSEC Alert Data. In Proc. of the RAID'03, Springer-Verlag, 2003.
11. K. Julisch and M. Dacier. Mining Intrusion Detection Alarms for Actionable Knowledge. In Proc. of the SIGKDD'02, 2002.
12. C. Kruegel and W. Robertson. Alert verification: Determining the success of intrusion attempts. In Proc. Of the DIMVA'06, Dortmund, Germany, July 2006.
13. T. Pietraszek, Using Adaptive Alert Classification to Reduce False Positives in Intrusion Detection, in Proc. Of 7th Symposium on Recent Advances in Intrusion Detection. Volume 3224 of LNCS., Springer-Verlag (2004) 102-124