<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-00481054</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T01:16:51+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Handling IDS' reliability in alert correlation: A Bayesian network-based model for handling IDS's reliability and controlling prediction/false alarm rate tradeoffs</title>
            <author role="aut">
              <persName>
                <forename type="first">Karim</forename>
                <surname>Tabia</surname>
              </persName>
              <email type="md5">f6fb92a3a6ce03dffda92bb4ec98056f</email>
              <email type="domain">cril.fr</email>
              <idno type="idhal" notation="string">karim-tabia</idno>
              <idno type="idhal" notation="numeric">768122</idno>
              <idno type="halauthorid" notation="string">449787-768122</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-8632-3980</idno>
              <affiliation ref="#struct-95421"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Philippe</forename>
                <surname>Leray</surname>
              </persName>
              <email type="md5">c91daaf4c97a04369abb28846cac493a</email>
              <email type="domain">univ-nantes.fr</email>
              <idno type="idhal" notation="string">philippe-leray</idno>
              <idno type="idhal" notation="numeric">1194</idno>
              <idno type="halauthorid" notation="string">6367-1194</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-0207-9280</idno>
              <idno type="GOOGLE SCHOLAR">http://scholar.google.com/citations?hl=en&amp;user=je4uPl0AAAAJ&amp;view_op=list_works</idno>
              <idno type="IDREF">https://www.idref.fr/116302011</idno>
              <affiliation ref="#struct-95421"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Karim</forename>
                <surname>Tabia</surname>
              </persName>
              <email type="md5">573f9135af5f8a419c1c6848012f0ff6</email>
              <email type="domain">univ-nantes.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2010-05-05 18:16:44</date>
              <date type="whenModified">2024-01-05 03:22:39</date>
              <date type="whenReleased">2010-05-05 18:16:44</date>
              <date type="whenProduced">2010-07-26</date>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="151069">
                <persName>
                  <forename>Karim</forename>
                  <surname>Tabia</surname>
                </persName>
                <email type="md5">573f9135af5f8a419c1c6848012f0ff6</email>
                <email type="domain">univ-nantes.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-00481054</idno>
            <idno type="halUri">https://hal.science/hal-00481054</idno>
            <idno type="halBibtex">tabia:hal-00481054</idno>
            <idno type="halRefHtml">&lt;i&gt;International Conference on Security and Cryptography (SECRYPT'2010)&lt;/i&gt;, Jul 2010, Athène, Greece. pp.11</idno>
            <idno type="halRef">International Conference on Security and Cryptography (SECRYPT'2010), Jul 2010, Athène, Greece. pp.11</idno>
            <availability status="restricted"/>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-NANTES">Université de Nantes</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="LINA" corresp="UNIV-NANTES">Laboratoire d'Informatique de Nantes Atlantique</idno>
            <idno type="stamp" n="LINA-COD" corresp="LINA">LINA - Equipe Connaissances, Optimisation, Décision</idno>
            <idno type="stamp" n="LINA-DUKE" corresp="LINA">LINA-DUKE</idno>
            <idno type="stamp" n="LS2N">Laboratoire des Sciences du Numérique de Nantes</idno>
            <idno type="stamp" n="NANTES-UNIVERSITE">Nantes Université</idno>
            <idno type="stamp" n="UNIV-NANTES-AV2022">Université de Nantes</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Handling IDS' reliability in alert correlation: A Bayesian network-based model for handling IDS's reliability and controlling prediction/false alarm rate tradeoffs</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Karim</forename>
                    <surname>Tabia</surname>
                  </persName>
                  <email type="md5">f6fb92a3a6ce03dffda92bb4ec98056f</email>
                  <email type="domain">cril.fr</email>
                  <idno type="idhal" notation="string">karim-tabia</idno>
                  <idno type="idhal" notation="numeric">768122</idno>
                  <idno type="halauthorid" notation="string">449787-768122</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-8632-3980</idno>
                  <affiliation ref="#struct-95421"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Philippe</forename>
                    <surname>Leray</surname>
                  </persName>
                  <email type="md5">c91daaf4c97a04369abb28846cac493a</email>
                  <email type="domain">univ-nantes.fr</email>
                  <idno type="idhal" notation="string">philippe-leray</idno>
                  <idno type="idhal" notation="numeric">1194</idno>
                  <idno type="halauthorid" notation="string">6367-1194</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-0207-9280</idno>
                  <idno type="GOOGLE SCHOLAR">http://scholar.google.com/citations?hl=en&amp;user=je4uPl0AAAAJ&amp;view_op=list_works</idno>
                  <idno type="IDREF">https://www.idref.fr/116302011</idno>
                  <affiliation ref="#struct-95421"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">Proceedings of SECRYPT'2010</title>
                <meeting>
                  <title>International Conference on Security and Cryptography (SECRYPT'2010)</title>
                  <date type="start">2010-07-26</date>
                  <date type="end">2010-07-28</date>
                  <settlement>Athène</settlement>
                  <country key="GR">Greece</country>
                </meeting>
                <imprint>
                  <biblScope unit="pp">11</biblScope>
                  <date type="datePub">2010-07-26</date>
                </imprint>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info.info-ai">Computer Science [cs]/Artificial Intelligence [cs.AI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Probabilistic graphical models are very efficient modeling and reasoning tools. In this paper, we propose an efficient and novel Bayesian network model for a major problem in alert correlation which plays a crucial role in nowadays computer security. Indeed, the use of multiple intrusion detection systems (IDSs) and complementary approaches is fundamental to improve the overall detection rates. This however inevitably rises huge amounts of alerts most of which are redundant and false alarms making the manual analysis of all the amounts of triggered alerts intractable. In this paper, we first propose a Bayesian network-based model allowing to handle the reliability of IDSs when predicting severe attacks by correlating the alerts reported by the IDSs monitoring the network. Then we propose a flexible and efficient approach especially designed to limit the false alarm rates by controlling the confidence of the prediction model. Finally, we provide experimental studies carried out on a real and representative alert corpus showing significant improvements regarding the tradeoffs between the prediction rates and the corresponding false alarm ones.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="laboratory" xml:id="struct-95421" status="OLD">
          <orgName>Laboratoire d'Informatique de Nantes Atlantique</orgName>
          <orgName type="acronym">LINA</orgName>
          <date type="end">2016-12-31</date>
          <desc>
            <address>
              <addrLine>LINA - Faculté des Sciences 2 rue de la Houssinière - BP 92208 44322 NANTES CEDEX 3</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.sciences.univ-nantes.fr/lina</ref>
          </desc>
          <listRelation>
            <relation active="#struct-84538" type="direct"/>
            <relation active="#struct-97058" type="direct"/>
            <relation active="#struct-93263" type="indirect"/>
            <relation name="UMR6241" active="#struct-441569" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-84538" status="OLD">
          <orgName>Mines Nantes</orgName>
          <orgName type="acronym">Mines Nantes</orgName>
          <date type="start">1991-10-08</date>
          <date type="end">2016-12-31</date>
          <desc>
            <address>
              <addrLine>La Chantrerie - 4, rue Alfred Kastler - BP 20722 - 44307 Nantes cedex 3</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.mines-nantes.fr/</ref>
          </desc>
        </org>
        <org type="regrouplaboratory" xml:id="struct-97058" status="OLD">
          <orgName>Université de Nantes - UFR des Sciences et des Techniques</orgName>
          <orgName type="acronym">UN UFR ST</orgName>
          <date type="end">2021-12-31</date>
          <desc>
            <address>
              <addrLine>2, rue de la Houssinière - BP 92208 - 44322 Nantes cedex 3</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.sciences-techniques.univ-nantes.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-93263" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-93263" status="OLD">
          <idno type="IdRef">026403447</idno>
          <idno type="ROR">https://ror.org/03gnr7b55</idno>
          <orgName>Université de Nantes</orgName>
          <orgName type="acronym">UN</orgName>
          <date type="end">2021-12-31</date>
          <desc>
            <address>
              <addrLine>1, quai de Tourville - BP 13522 - 44035 Nantes cedex 1</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-nantes.fr/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>