Classification Of Alerts Research Articles

Clinical and epidemiological features and therapeutic options of avascular necrosis in patients with sickle cell disease (SCD): a cross-sectional study.

Avascular necrosis (AVN) is a debilitating complication in sickle cell disease (SCD) patients, and its management is usually challenging. This study aims to evaluate the clinical and epidemiological features and therapeutic options of AVN in sickle cell patients in Qatar. A cross-sectional study was conducted on a 49 SCD patients who were diagnosed with AVN and attended the hematology clinic at the National Center for Cancer care & research, Hamad Medical Corporation, Qatar between Jan-2011 to Jan2021. Results: Forty-nine adult patients with SCD who were diagnosed with AVN were studied. The median age of the study population is 32 years, and the median age at the first AVN diagnosis was 26 years (range: 11-44 yr.). 37 (75.5%) patients suffered from multiple joints AVN while 12(24.5%) had single joint involvement. 31 (63.3%) patients had bilateral hip AVN and 18 (36.7%) had shoulder involvement. 30 patients (61%) were on Hydroxyurea treatment. Based on FICAT and Alert classification of AVN, 57 % of patients had stage III and above at first diagnosis. 20 (40.8%) were managed with a conservative approach, 11 (22.4%) received hyperbaric oxygen with good response, 6(12.2%) underwent hip core decompression and 12(24.5%) underwent hip replacement surgery. In SCD patients, AVN occurred more during the 3rd and 4th decades of life. The majority of AVN represented with advanced stage and had multiple joint involvements. We recommend adopting a low threshold of joint imaging for early detection and prevention of further complications.

Cybercopters Swarm: Immersive analytics for alerts classification based on periodic data

This paper assesses the usefulness of an interactive and navigable 3D environment to help decision-making in cybersecurity. Malware programs frequently emit periodic signals in network logs; however, normal periodical network activities, such as software updates and data collection activities, mask them. Thus, if automatic systems use periodicity to successfully detect malware, they also detect ordinary activities as suspicious ones and raise false positives. Hence, there is a need to provide tools to sort the alerts raised by such software. Data visualizations can make it easier to categorize these alerts, as proven by previous research. However, traditional visualization tools can struggle to display a large amount of data that needs to be treated in cybersecurity in a clear way. In response, this paper explores the use of Immersive Analytics to interact with complex dataset representations and collect cues for alert classification. We created a prototype that uses a helical representation to underline periodicity in the distribution of one variable of a dataset. We tested this prototype in an alert triage scenario and compared it with a state-of-the-art 2D visualization with regard to the visualization efficiency, usability, workload, and flow induced.

AD ALERT Classification of Alzheimer disease with Traditional and Deep Network Models

AD ALERT Classification of Alzheimer disease with Traditional and Deep Network Models

Clinical and Epidemiological Features and Therapeutic Options of Avascular Necrosis in Sickle Cell Patients: A Cross-Sectional Study

Background: Vascular necrosis (AVN) is a well-described debilitating complication in sickle cell disease (SCD) patients, and the management is usually challenging. Data about the clinical presentation, risk factors, radiological features, and management options are lacking. This study aims to evaluate the clinical and epidemiological features and therapeutic options of avascular necrosis in sickle cell patients in Qatar. Patients and methods: A cross-sectional study was conducted on a group of 49 sickle cell disease patients who are suffering from avascular necrosis and attending a hematology clinic at the National Center for Cancer care & research hospital (NCCCR), Hamad Medical Corporation (HMC), Qatar between Jan-2011 to Jan2021. Clinical presentation, age at first AVN diagnosis, hemoglobin S level, affected joints, hydroxyurea treatment and compliance, and stage at diagnosis were recorded. Management options included conservative physiotherapy, hyperbaric oxygen, core decompression, and hip replacement. Results: Forty-nine adult patients with sickle cell disease complicated by avascular necrosis were reviewed. The median age of the study population is 32 years (range: 18-64) and the median age of AVN diagnosis is 26 years (range: 11-44). 25 patients (51 %) were males. 41 patients (83.6%) had hemoglobin SS, 3 (6.1%) with hemoglobin S/D (double Heterozygosity), 3 (6.1%) hemoglobin C/S, 1 (2.1%) with hemoglobin S/E, and 1 (2.1%) with sickle/thalassemia. 37 (75.5%) patients suffered from multiple joints AVN while 12(24.5%) had single joint involvement. 31 (63.3%) patients had bilateral hip AVN and 18 (36.7%) had shoulder involvement. The majority of the patients (79%) were symptomatic where joint pain and a limited range of motion were the most common symptoms. 30 patients (61%) of the recruited population were on Hydroxyurea; six of them (20%) were non-compliant. Based on FICAT and Alert classification of AVN, 8 (16.3%) patients had stage I, 13(26.5%) had stage II, 9 (18.4%) had stage III and 13 (26.5%)patients were at stage IV; 6(12.3%) patients were at stage V. 57 % of patients had stage III and above at diagnosis. 20 (40.8%) were managed with a conservative approach with physiotherapy only, 11 (22.4%) received hyperbaric oxygen with good response, 6(12.2%) underwent hip core decompression and 12(24.5%) underwent a hip replacement. Conclusion: The majority of AVN patients had an advanced stage and multiple joint involvements at diagnosis. We suggest a low threshold of joint imaging for early detection and prevention of further complications. Hyperbaric oxygen, if implemented early, might be a possible option to avoid or delay surgical intervention. Figure 1View largeDownload PPTFigure 1View largeDownload PPT Close modal

Appropriateness of Alerts and Physicians' Responses With a Medication-Related Clinical Decision Support System: Retrospective Observational Study.

BackgroundAlert fatigue is unavoidable when many irrelevant alerts are generated in response to a small number of useful alerts. It is necessary to increase the effectiveness of the clinical decision support system (CDSS) by understanding physicians’ responses.ObjectiveThis study aimed to understand the CDSS and physicians’ behavior by evaluating the clinical appropriateness of alerts and the corresponding physicians’ responses in a medication-related passive alert system.MethodsData on medication-related orders, alerts, and patients’ electronic medical records were analyzed. The analyzed data were generated between August 2019 and June 2020 while the patient was in the emergency department. We evaluated the appropriateness of alerts and physicians’ responses for a subset of 382 alert cases and classified them.ResultsOf the 382 alert cases, only 7.3% (n=28) of the alerts were clinically appropriate. Regarding the appropriateness of the physicians’ responses about the alerts, 92.4% (n=353) were deemed appropriate. In the classification of alerts, only 3.4% (n=13) of alerts were successfully triggered, and 2.1% (n=8) were inappropriate in both alert clinical relevance and physician’s response. In this study, the override rate was 92.9% (n=355).ConclusionsWe evaluated the appropriateness of alerts and physicians’ responses through a detailed medical record review of the medication-related passive alert system. An excessive number of unnecessary alerts are generated, because the algorithm operates as a rule base without reflecting the individual condition of the patient. It is important to maximize the value of the CDSS by comprehending physicians’ responses.

SMS-I: Intelligent Security for Cyber–Physical Systems

Critical infrastructures are an attractive target for attackers, mainly due to the catastrophic impact of these attacks on society. In addition, the cyber–physical nature of these infrastructures makes them more vulnerable to cyber–physical threats and makes the detection, investigation, and remediation of security attacks more difficult. Therefore, improving cyber–physical correlations, forensics investigations, and Incident response tasks is of paramount importance. This work describes the SMS-I tool that allows the improvement of these security aspects in critical infrastructures. Data from heterogeneous systems, over different time frames, are received and correlated. Both physical and logical security are unified and additional security details are analysed to find attack evidence. Different Artificial Intelligence (AI) methodologies are used to process and analyse the multi-dimensional data exploring the temporal correlation between cyber and physical Alerts and going beyond traditional techniques to detect unusual Events, and then find evidence of attacks. SMS-I’s Intelligent Dashboard supports decision makers in a deep analysis of how the breaches and the assets were explored and compromised. It assists and facilitates the security analysts using graphical dashboards and Alert classification suggestions. Therefore, they can more easily identify anomalous situations that can be related to possible Incident occurrences. Users can also explore information, with different levels of detail, including logical information and technical specifications. SMS-I also integrates with a scalable and open Security Incident Response Platform (TheHive) that enables the sharing of information about security Incidents and helps different organizations better understand threats and proactively defend their systems and networks.

Dealing with Security Alert Flooding: Using Machine Learning for Domain-independent Alert Aggregation

Intrusion Detection Systems (IDS) secure all kinds of IT infrastructures through automatic detection of malicious activities. Unfortunately, they are known to produce large numbers of alerts that often become overwhelming for manual analysis. Therefore, aggregation methods have been developed for filtering, grouping, and correlating alerts. However, existing techniques either rely on manually defined attack scenarios or require specific alert formats, such as IDMEF that include IP addresses. This makes the application of existing aggregation methods infeasible for alerts from host-based or anomaly-based IDSs that frequently lack such network-related data. In this paper, we therefore present a domain-independent alert aggregation technique. We introduce similarity measures and merging strategies for arbitrary semi-structured alerts and alert groups. Based on these metrics and techniques we propose an incremental procedure for the generation of abstract alert patterns that enable continuous classification of incoming alerts. Evaluations show that our approach is capable of reducing the number of alert groups for human review by around \( 80\% \) and assigning attack classifiers to the groups with true positive rates of \( 80\% \) and false positive rates lower than \( 5\% \) .

Detection of alertness-related EEG signals based on decision fused BP neural network

Alertness detection has been used to monitor operators in key positions to avoid accidents. The widely used methods (such as machine vision) are susceptible to external factors and cannot quantify alertness. In contrast, EEG has the advantages of intuitively reflecting brain activities and not being easily affected. Based on EEG signals, an alertness detection method using decision fused BP (back propagation, BP) neural network was presented. In this paper, we analyzed the EEG changes of 20 participants while performing tasks. During PVT (Psychomotor Vigilance Task, PVT), EEG signals were collected through the acquisition platform we designed, and KSS (Karolinska Sleepiness Scale, KSS) was completed. AR (autoregressive model, AR) and PSD (power spectral density, PSD) were applied to extract frequency domain features of EEG signals. The extracted features were then input into BP neural network separately. Afterwards, we used DS (Dempster–Shafer, DS) method to fuse output results of BP neural network. When comparing results of the proposed classification methods, we concluded that BP-DS method had the finest classification results (including AUC-ROC curve, accuracy, precision, and recall rate) with the accuracy increasing considerably from 0.661 to 0.911. In addition, among six EEG indices, Rβ,α+θ/β,α/β presented prominent changes during alertness variation. The proposed alertness classification algorithm monitors alertness continuously and avoids potential catastrophes caused by decreased alertness. It can be applied in monitoring systems to prevent mental fatigue and declined work efficiency of air traffic controllers, medical staff and other fields.

Volcanic alert system by lightning detection using the WWLLN - ash cloud monitor

Electrical discharges are observed in many volcanic eruptions and they have often been used as indicators of such eruptions. Volcanic lightning is remarkably similar to those produced during thunderstorms and is called analogous to thunderstorm-like plume lightning. The WWLLN developed a program called “Ash Cloud Monitor” (ACM), in which alerts are issued for possible volcanic eruptions when lightning strokes are detected around a volcano. The ACM tool has demonstrated to be a very effective technique to be aware of volcanic eruptions. However, most of the alerts released by ACM belong to false alarms of volcanic activity, because, in general, the detected lightning is produced by thunderstorms near the volcano.In order to assess and improve the ACM to detect volcanic eruptions, reducing false alert emissions and improving the quick interpretation of them, we develop a web platform called Georayos-VolcanoAr with a new structure and a modified algorithm, with respect to the algorithm used by ACM, for the classification of alerts. The new algorithm considers an alert system with 3 levels: Red - Yellow - Green, with the Red alert being the highest level and decreasing towards Green. The Red alert was assigned to those volcanoes where only recorded lightning within a radius of 20 km or the lightning detected within a radius of 20 km is at least twice as much as that detected up to 100 km from the vent.The study focused on 32 volcanoes located in the Andes, close to the Argentine-Chilean border, and analyzed the results reported by the ACM network in terms of a climatological study of the lightning activity, thunderstorm days and predominant winds in that region. This analysis serves as a basis for a general recognition of the study zone in order to improve the interpretation of the distribution and generation of false alerts; as well as to help decision makers, among others, to have a reference that allows them to issue the warning.

Anomaly detection and optimization using scalable and flexible network data characterization

In the context of information security, cyber-attacks such as malware attacksviruses, etc. caused substantial damage to many organizations. The most common solution to cyber-attack is cryptography algorithm implementation and Intrusion Detection System (IDS). Different cryptography algorithms with varying key length are used to achieve different level of information security. IDS is used to control and alert the cyber-attacks which are much redundant and generates many false alerts in real-life application. The filtering and classification of false alerts involve substantial investment and security analysis. We propose a self-Learning data management approach in terms of data characterization using SeLINA for minimizing false alerts. Two different queues namely: Normal Queue and Suspicious Queues are used for storing information without and with any false alert respectively. The Suspicious Queue then undergoes filtering using feature detection technique. Subsequently, the filtered information with no false alert signals is transferred to the Normal Queue using a supervised hierarchical structure towards minimization of false alerts. Consequently, this technique is helpful to identify malicious attacks easily with no extra time for false alert detection.

Automatic EEG-based Alertness Classification using Sparse Representation and Dictionary Learning

Automation of human alertness identification has been widely investigated in recent decades. Many applications can benefit from automatic alertness state identification, such as driver fatigue detection, monotonous task workers' vigilance detection and sleep studies in the medical field. Many researchers have tried to exploit different types of behavioural aspects in vigilance detection, such as eye movement, head position and facial expression. On the other hand, some biomedical signals like ECG, EEG and heart rhythm are also exploited; however, there is a consensus of the superiority of EEG signal in alertness classification due to its close relation with different human vigilant states. In this paper, we propose an automatic method for vigilance detection using a single EEG channel along with sparse representation and dictionary learning. We used Discrete Wavelet Packet Transform to extract the features related to different human vigilance states. We use well-known other classifiers to compare the performance of our proposed method. Results of classification with sparse representation and dictionary learning produced better accuracy results than the other methods.

The value of a novel model of remote monitoring alert classification of cardiac implantable devices

Abstract Introduction Remote monitoring (RM) is commonly used in the follow-up of patients with cardiac implantable devices (CID). However, there are a significant amount of automatic alerts of low clinical relevance. An alert classification model designed to optimize the management of RM alert in CID receivers can improve the analysis. Purpose Assess the effectiveness of a local protocol for review and classification of MR alerts. Methods Retrospective study, single center. We included all patients with ICD +/− CRT in the RM program between september 2016 and december 2019. All transmission received were analyzed. The priority of the transmissions was established based on clinical criteria and device parameters, classified into 3 categories from lowest to highest priority: green, yellow and red. Each category involved a specific action protocol (Figure 1). The categorization by colors was initially carried out by a remote support center, based on data from the devices; and later, reviewed by arrhythmia nurse team who incorporated clinical information data. In case of discrepancy, the alert was again evaluated together with the cardiologist. The degree of concordance in the categorization of alerts was analyzed, as well as the transmission response time (TRT): support center- care team. Results In our center a total of 1013 patients were included (68±14 years old, 76% male), who completed 8755 remote transmissions. The initial classification of transmissions by the support center was: 6890 (78.7%) green, 1497 (17.1%) yellow and 368 (4.2%) red. Only 0.62% of transmissions required reclassification by the healthcare team. No alert initially classified as yellow or green should be reclassified to red. The TRT was 3.35 hours for the red transmissions and 5.6 hours for the yellow ones. Conclusion The categorization of alerts in our RM system allows an efficient and safe organization of assitance to patients with CID. Funding Acknowledgement Type of funding source: None

Novel Pattern Matching based Alert Classification Approach For Intrusion Detection System

Novel Pattern Matching based Alert Classification Approach For Intrusion Detection System

Transit and non-transit 3D EPID dosimetry versus detector arrays for patient specific QA.

PurposeDespite their availability and simplicity of use, Electronic Portal Imaging Devices (EPIDs) have not yet replaced detector arrays for patient specific QA in 3D. The purpose of this study is to perform a large scale dosimetric evaluation of transit and non‐transit EPID dosimetry against absolute dose measurements in 3D.MethodsAfter evaluating basic dosimetric characteristics of the EPID and two detector arrays (Octavius 1500 and Octavius 1000SRS), 3D dose distributions for 68 VMAT arcs, and 10 IMRT plans were reconstructed within the same phantom geometry using transit EPID dosimetry, non‐transit EPID dosimetry, and the Octavius 4D system. The reconstructed 3D dose distributions were directly compared by γ‐analysis (2L2 = 2% local/2 mm and 3G2 = 3% global/2 mm, 50% isodose) and by the percentage difference in median dose to the high dose volume (%∆HDVD 50).ResultsRegarding dose rate dependency, dose linearity, and field size dependence, the agreement between EPID dosimetry and the two detector arrays was found to be within 1.0%. In the 2L2 γ‐comparison with Octavius 4D dose distributions, the average γ‐pass rate value was 92.2 ± 5.2%(1SD) and 94.1 ± 4.3%(1SD) for transit and non‐transit EPID dosimetry, respectively. 3G2 γ‐pass rate values were higher than 95% in 150/156 cases. %∆HDVD 50 values were within 2% in 134/156 cases and within 3% in 155/156 cases. With regard to the clinical classification of alerts, 97.5% of the treatments were equally classified by EPID dosimetry and Octavius 4D.ConclusionTransit and non‐transit EPID dosimetry are equivalent in dosimetric terms to conventional detector arrays for patient specific QA. Non‐transit 3D EPID dosimetry can be readily used for pre‐treatment patient specific QA of IMRT and VMAT, eliminating the need of phantom positioning.

Avascular Necrosis of the Femoral Head in Sickle Cell Disease in Egypt and Oman: A Cross Sectional Study

BACKGROUND:Avascular necrosis (AVN) especially of the femoral head has long been recognized as a morbidity of sickle cell disease (SCD). AVN might be of gradual onset and silent or run a more acute course with severe pain and limping.The clinical presentations and risk factors of this complication among Egyptian and Omani children and young adults with SCD were not fully studied. We aimed to determine the patterns of presentation, risk factors, diagnosis and management of avascular necrosis of the hip in SCD in the 2 centers.PATIENTS AND METHODS: A cross sectional study carried out at the Pediatric Hematology clinics of Ain Shams and Sultan Qaboos University Hospitals. All young SCD patients diagnosed with hip AVN during the period between Jan. 2010-Jan. 2018 were included. Age of 1st presentation with SCD, symptoms or signs of AVN, frequency of VOCs, hospital admissions and transfusion, spleen status, hydroxyurea administration (dose and compliance ), radiological findings (X-ray and MRI using FICAT and Arlet Staging) and serum ferritin were recorded. Therapeutic options included physiotherapy, autologous bone marrow stem cell injection in the affected joint, hip coring, and hip replacement.RESULTS:Sixty-eight children, adolescents and young adults with SCD and AVN; aged 8-22 years of both sexes were recruited from two centers; Egypt; n= 22, and Oman; n= 46. Twenty patients (29.4%) had hemoglobin SS while 48 (70.6%) had Sickle-βThalassemia. Thirty-seven (54%), were males with a median age of 16 years, five out of the 22 Egyptians have in addition to hip AVN, femoral shaft necrosis in one patient and 2 have lumbar vertebra necrosis. According to FICAT and Alert classification of AVN; 22 patients had stage 0, 2 patients had stage I, 13 patients had stage II, 14 had stage III and 17 patients were at stage IV; 64% of patients had stage II and above at diagnosis. Sixty percent of the studied population were on Hydroxyurea; of them 25% were non-compliant. Multivariate regression analysis didn't show a significant risk factor for development of AVN in these patients. Management was different in the 2 centers; Half of the patients in Oman were managed with physiotherapy alone; while only 25% in Egypt. Stem cell injection in the bone marrow of the affected hip was tried in 25% of Omani patients with good success while none in the Egyptian patients. Hip replacement in was performed in a total of 7 patients and Bone marrow transplantation in two.CONCLUSION:Avascular necrosis of the hip is a significant cause of morbidity in SCD in this part of the world. Majority of patients had an advanced disease at diagnosis, which emphasizes the need of early screening to avoid complications of the advanced disease. Injection of bone marrow in the affected hip might be a promising tool to prevent disease progression and improve the symptoms. DisclosuresNo relevant conflicts of interest to declare.

Machine-learning-based Brokers for Real-time Classification of the LSST Alert Stream

Abstract The unprecedented volume and rate of transient events that will be discovered by the Large Synoptic Survey Telescope (LSST) demand that the astronomical community update its follow-up paradigm. Alert-brokers—automated software system to sift through, characterize, annotate, and prioritize events for follow-up—will be critical tools for managing alert streams in the LSST era. The Arizona-NOAO Temporal Analysis and Response to Events System (ANTARES) is one such broker. In this work, we develop a machine learning pipeline to characterize and classify variable and transient sources only using the available multiband optical photometry. We describe three illustrative stages of the pipeline, serving the three goals of early, intermediate, and retrospective classification of alerts. The first takes the form of variable versus transient categorization, the second a multiclass typing of the combined variable and transient data set, and the third a purity-driven subtyping of a transient class. Although several similar algorithms have proven themselves in simulations, we validate their performance on real observations for the first time. We quantitatively evaluate our pipeline on sparse, unevenly sampled, heteroskedastic data from various existing observational campaigns, and demonstrate very competitive classification performance. We describe our progress toward adapting the pipeline developed in this work into a real-time broker working on live alert streams from time-domain surveys.

EEG rhythm/channel selection for fuzzy rule-based alertness state characterization

The aim of the paper is to automatically select the optimal EEG rhythm/channel combinations capable of classifying human alertness states. Four alertness states were considered, namely ‘engaged’, ‘calm’, ‘drowsy’ and ‘asleep’. The features used in the automatic selection are the energies associated with the conventional rhythms, \(\delta , \theta , \alpha , \beta\) and \(\gamma\), extracted from overlapping windows of the different EEG channels. The selection process consists of two stages. In the first stage, the optimal brain regions, represented by sets of EEG channels, are selected using a simple search technique based on support vector machine (SVM), extreme learning machine (ELM) and LDA classifiers. In the second stage, a fuzzy rule-based alertness classification system (FRBACS) is used to identify, from the previously selected EEG channels, the optimal features and their supports. The IF–THEN rules used in FRBACS are constructed using a novel differential evolution-based search algorithm particularly designed for this task. Each alertness state is represented by a set of IF–THEN rules whose antecedent parts contain EEG rhythm/channel combination. The selected spatio-frequency features were found to be good indicators of the different alertness states, as judged by the classification performance of the FRBACS that was found to be comparable to those of the SVM, ELM and LDA classifiers. Moreover, the proposed classification system has the advantage of revealing simple and easy to interpret decision rules associated with each of the alertness states.

Multi-source alert data understanding for security semantic discovery based on rough set theory

To secure the network system, a large number of different information security devices, e.g., intrusion detection system, firewall, etc., have been deployed in the network. These devices can protect the network system from all aspects, but also bring new problems for information security administration. Massive alert data from different devices are increasingly generated and some real alerts are buried with the overwhelming alerts, which are mixed with a large amount of repetitive and false alerts. In this paper, we propose a multi-source alert data understanding scheme based on rough set theory for security semantic discovery. Firstly, we classify the alert data according to the data features to merge the multi-source alerts. Then, we calculate the weight for each classification of alerts by applying the rough set theory to historical data. Then we perform data aggregation by alert similarity computation to reduce repetitive alerts from different sources. Also, we introduce reliability metrics to measure the credibility of different alerts for further correlation and semantic analysis according to the network background information. We perform experiments on the collected data set in the real network system and DARPR 2000 data set. Experimental results show that our proposed method could reduce more than 80% repetitive alerts in the data sets.

Standardisation and Classification of Alerts Generated by Intrusion Detection Systems

Intrusion detection systems are most popular de-fence mechanisms used to provide security to IT infrastructures. Organisation need best performance, so it uses multiple IDSs from different vendors. Different vendors are using different formats and protocols. Difficulty imposed by this is the generation of several false alarms. Major part of this work concentrates on the collection of alerts from different intrusion detection systems to represent them in IDMEF(Intrusion Detection Message Exchange Format) format. Alerts were collected from intrusion detection systems like snort, ossec, suricata etc. Later classification is attempted using machine learning technique, which helps to mitigate generation of false positives.

A model for anomaly classification in intrusion detection systems

Intrusion Detection Systems (IDS) are traditionally divided into two types according to the detection methods they employ, namely (i) misuse detection and (ii) anomaly detection. Anomaly detection has been widely used and its main advantage is the ability to detect new attacks. However, the analysis of anomalies generated can become expensive, since they often have no clear information about the malicious events they represent. In this context, this paper presents a model for automated classification of alerts generated by an anomaly based IDS. The main goal is either the classification of the detected anomalies in well-defined taxonomies of attacks or to identify whether it is a false positive misclassified by the IDS. Some common attacks to computer networks were considered and we achieved important results that can equip security analysts with best resources for their analyses.