Efficient Security Alert Management System

International Journal of Computer Science and Security

Minoo Deljavan Anvary¹  Amir Azimi Alasti Ahrabi¹  Majid Ghonji Feshki¹ 

[1] $$

关键词: Intrusion Detection;    Security Alert Management;    K-nearest Neighbor;    Real-time Security Alert Classification;    Reduction of False Positive Alerts;    Precise Classifying True Positive Alerts.;   

DOI  :  

来源: Computer Science and Security

【 摘 要 】

Nowadays there are several security tools that used to protect computer systems, computer networks, smart devices and etc. against attackers. Intrusion detection system is one of tools used to detect attacks. Intrusion Detection Systems produces large amount of alerts, security experts could not investigate important alerts, also many of that alerts are incorrect or false positives. Alert management systems are set of approaches that used to solve this problem. In this paper a new alert management system is presented. It uses K-nearest neighbor as a core component of the system that classify generated alerts. The suggested system serves precise results against huge amount of generated alerts. Because of low classification time per each alert, the system also could be used in online systems.

【 授权许可】

Unknown