学位论文详细信息
A Fuzzy-logic based Alert Prioritization Engine for IDSs: Architecture and Configuration
Security;Intrusion detection;alert management;IDS;Computer Science
Alsubhi, Khalid
University of Waterloo
关键词: Security;    Intrusion detection;    alert management;    IDS;    Computer Science;   
Others  :  https://uwspace.uwaterloo.ca/bitstream/10012/3479/1/Khalid%20MMath%20Thesis.pdf
瑞士|英语
来源: UWSPACE Waterloo Institutional Repository
PDF
【 摘 要 】
Intrusion Detection Systems (IDSs) are designed to monitor a networked environment and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large making their evaluation by security analysts a difficult task. The management is complicated by the need to configure the different components of alert evaluation systems. In addition, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide results that are inaccurate and difficult to manage. Thus, the tuning of an IDS alert management system in order to provide optimal results remains a major challenge, which is further complicated by the large spectrum of potential attacks the system can be subject to. This thesis considers the specification and configuration issues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy-logic based approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique that leads to a further reduction of the number of alerts. We study the impact of different configurations of the proposed metrics on the accuracy and completeness of the alert scores generated by FuzMet. Our approach is validated using the 2000 DARPA intrusion detection scenario specific datasets and comparative results between the Snort IDS alert scoring and FuzMet alert prioritization scheme are presented. A considerable number of simulations were conducted in order to determine the optimal configuration of FuzMet with selected simulation results presented and analyzed.
【 预 览 】
附件列表
Files Size Format View
A Fuzzy-logic based Alert Prioritization Engine for IDSs: Architecture and Configuration 5247KB PDF download
  文献评价指标  
  下载次数:24次 浏览次数:52次