Using attack information to reduce false positives in network IDS

Makoto Shimamura, Kenji Kono

Research output: Chapter in Book/Report/Conference proceedingConference contribution

8 Citations (Scopus)


Reducing the rate of false positives is of vital importance in enhancing the usefulness of signature-based network intrusion detection systems (NIDSs). To reduce false positives, a network administrator must throughly investigate a lengthy list of signatures and carefully disable the ones that detect attacks not harmful to the user's environment. This is a daunting task; if some signatures are disabled by mistake, the NIDSfails to detect critical remote attacks. We designed a NIDS, TrueAlarm, to reduce the rate of false positives. Conventional NIDSs alert administrators to the detection of a malicious message, regardless of whether the message actually attempts to compromise the protected server. In contrast, TrueAlarm delays the alert until it confirms that an attempt has been made. In TrueAlarm, NIDS cooperates with a server-side monitor that observes the protected server's behavior. TrueAlarm alerts administrators only when a server-side monitor detects deviant server behavior that must have been caused by a message detected by NIDS. Our experimental results show that TrueAlarm reduces the rate of false positives. Using real network traffic collected over 15 days, TrueAlarm produced no false positives, while a conventional NIDS produced 125.

Original languageEnglish
Title of host publicationProceedings - 11th IEEE Symposium on Computers and Communications, ISCC 2006
PublisherInstitute of Electrical and Electronics Engineers Inc.
Number of pages8
ISBN (Print)0769525881, 9780769525884
Publication statusPublished - 2006
Event11th IEEE Symposium on Computers and Communications, ISCC 2006 - Cagliari, Sardinia, Italy
Duration: 2006 Jun 262006 Jun 29

Publication series

NameProceedings - International Symposium on Computers and Communications
ISSN (Print)1530-1346


Other11th IEEE Symposium on Computers and Communications, ISCC 2006
CityCagliari, Sardinia

ASJC Scopus subject areas

  • Software
  • Signal Processing
  • Mathematics(all)
  • Computer Science Applications
  • Computer Networks and Communications


Dive into the research topics of 'Using attack information to reduce false positives in network IDS'. Together they form a unique fingerprint.

Cite this