Contextual‐based approach to reduce false positives

Abstract

The high rate of false positive alerts generated by the intrusion detection system (IDS), raises a crucial problem in the face of the security operator to differentiate between true attacks and failed ones. In order to solve this problem, several approaches have been developed relying on contextual information such as applications, services, network location, and vulnerabilities. The change of the context can be an effective factor to reduce false positive rate. However, most approaches in the literature have not dealt with this factor. Therefore, the authors propose non-monotonic ontology contextual-based approach (NOC-IDS), which represents a set of helpful contextual information in flexible format and dynamic reasoning. NOC-IDS aims in general to filter false positive alerts and to figure out relevant alerts, and helping the security operator to analyse relevant ones. NOC-IDS is defined by the description logic J C l a s s i c δ ϵ that provides non-monotonic reasoning. They illustrate the effectiveness and the powerfulness of the authors’ approach using the well-known DARPA 2000 data set.