Using attack information to reduce false positives in network IDS

Makoto Shimamura, Kenji Kono

Research output: Chapter in Book/Report/Conference proceedingConference contribution

9 Citations (Scopus)

Abstract

Reducing the rate of false positives is of vital importance in enhancing the usefulness of signature-based network intrusion detection systems (NIDSs). To reduce false positives, a network administrator must throughly investigate a lengthy list of signatures and carefully disable the ones that detect attacks not harmful to the user's environment. This is a daunting task; if some signatures are disabled by mistake, the NIDSfails to detect critical remote attacks. We designed a NIDS, TrueAlarm, to reduce the rate of false positives. Conventional NIDSs alert administrators to the detection of a malicious message, regardless of whether the message actually attempts to compromise the protected server. In contrast, TrueAlarm delays the alert until it confirms that an attempt has been made. In TrueAlarm, NIDS cooperates with a server-side monitor that observes the protected server's behavior. TrueAlarm alerts administrators only when a server-side monitor detects deviant server behavior that must have been caused by a message detected by NIDS. Our experimental results show that TrueAlarm reduces the rate of false positives. Using real network traffic collected over 15 days, TrueAlarm produced no false positives, while a conventional NIDS produced 125.

Original languageEnglish
Title of host publicationProceedings - 11th IEEE Symposium on Computers and Communications, ISCC 2006
Pages386-393
Number of pages8
DOIs
Publication statusPublished - 2006 Dec 1
Event11th IEEE Symposium on Computers and Communications, ISCC 2006 - Cagliari, Sardinia, Italy
Duration: 2006 Jun 262006 Jun 29

Publication series

NameProceedings - International Symposium on Computers and Communications
ISSN (Print)1530-1346

Other

Other11th IEEE Symposium on Computers and Communications, ISCC 2006
CountryItaly
CityCagliari, Sardinia
Period06/6/2606/6/29

ASJC Scopus subject areas

  • Software
  • Signal Processing
  • Mathematics(all)
  • Computer Science Applications
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Using attack information to reduce false positives in network IDS'. Together they form a unique fingerprint.

  • Cite this

    Shimamura, M., & Kono, K. (2006). Using attack information to reduce false positives in network IDS. In Proceedings - 11th IEEE Symposium on Computers and Communications, ISCC 2006 (pp. 386-393). [1691059] (Proceedings - International Symposium on Computers and Communications). https://doi.org/10.1109/ISCC.2006.165