False Alarm Reduction: A Profiling Mechanism and New Research Directions
Résumé
Intrusion detection systems (IDSs) are commonly used to detect attacks on computer networks. These tools analyze incoming and outgoing traffic for suspicious anomalies or activities. Unfortunately, these generate a significant amount of noise complexifying greatly the analysis of the data. This chapter addresses the problem of false alarms in IDSs. Its first purpose is to improve their accuracy by detecting real attacks and by reducing the number of unnecessary alerts. To do so, this intrusion detection mechanism enhances the accuracy of anomaly intrusion detection systems using a set of agents to ensure the detection and the adaptation of normal profile to support the legitimate changes that occur over time and are the cause of many false alarms. Besides this, as a perspective of this work, this chapter opens up new research directions by listing the different requirements of an IDS and proposing solutions to achieve them.