Intrusion Detection Systems Alerts Research Articles

Prevention in Healthcare: An Explainable AI Approach

Intrusion prevention is a critical aspect of maintaining the security of healthcare systems, especially in the context of sensitive patient data. Explainable AI can provide a way to improve the effectiveness of intrusion prevention by using machine learning algorithms to detect and prevent security breaches in healthcare systems. This approach not only helps ensure the confidentiality, integrity, and availability of patient data but also supports regulatory compliance. By providing clear and interpretable explanations for its decisions, explainable AI can enable healthcare professionals to understand the reasoning behind the intrusion detection system's alerts and take appropriate action. This paper explores the application of explainable AI for intrusion prevention in healthcare and its potential benefits for maintaining the security of healthcare systems.

Metrics for Evaluating Alerts in Intrusion Detection Systems

Network intrusions compromise the network’s confidentiality, integrity and availability of resources. Intrusion detection systems (IDSs) have been implemented to prevent the problem. Although IDS technologies are promising, their ability of detecting true alerts is far from being perfect. One problem is that of producing large numbers of false alerts, which are termed as malicious by the IDS. In this paper we propose a set of metrics for evaluating the IDS alerts. The metrics will identify false, low-level and redundant alerts by mapping alerts on a vulnerability database and calculating their impact. The metrics are calculated using a metric tool that we developed. We validated the metrics using Weyuker’s properties and Kaner’s framework. The metrics can be considered as mathematically valid since they satisfied seven of the nine Weyuker’s properties. In addition, they can be considered as workable since they satisfied all the evaluation questions from Kaner’s framework.

Snort ids system visualization interface for alert analysis

Over the past decades, the rapid Internet development and the growth in the number of its users have raised various security issues. Therefore, it is of great importance to ensure the security of the network in order to enable the safe exchange of confidential data, as well as their integrity. One of the most important components of network attack detection is an Intrusion Detection System (IDS). Snort IDS is a widely used intrusion detection system, which logs alerts after detecting potentially dangerous network packets. A major challenge in network monitoring is the high volume of generated IDS alerts. A necessary step in successful network protection is the analysis of the great amount of logged alerts in search of deviations from normal traffic that may indicate an intrusion. The goal of this paper is to design and implement a visualization interface for IDS alert analysis, which graphically presents alerts generated by Snort IDS. Also, the proposed system classifies the alerts according to the most important attack parameters, and allows the users to understand evolving network situations and easily detect possible traffic irregularities. An environment in which the system has been tested in real-time is described, and the results of attack detection and classification are given. One of the detected attacks is analyzed in detail, as well as the method of its detection and its possible consequences.

Hybridized Design For Feature Optimization and Reduction of Intrusion Detection Systems Alert in a Correlation Framework

The Intrusion Detection System (IDS) produces a large number of alerts. Many large organizations deploy numerous IDSs in their network, generating an even larger quantity of these alerts, where some are real or true alerts and several others are false positives. These alerts cause very severe complications for IDS and create difficulty for the security administrators to ascertain effective attacks and to carry out curative measures. The categorization of such alerts established on their level of attack is necessary to ascertain the most severe alerts and to minimize the time required for response. An improved hybridized model was developed to assess and reduce IDS alerts using the combination of the Genetic Algorithm (GA) and Support Vector Machine (SVM) Algorithm in a correlation framework. The model is subsequently referred to as GA-SVM Alert Correlation (GASAC) model in this study. Our model was established employing the object-oriented analysis and design software methodology and implemented with Java programming language. This study will be benefitted by cooperating with networked organizations since only real alerts will be generated in a way that security procedures can be quickly implemented to protect the system from both interior and exterior attacks

The role of information about opponent’s actions and intrusion-detection alerts on cyber decisions in cyber security games

Cyberspace is becoming increasingly prone to cyberattacks. Cyberattack and cyber-defend decisions may be influenced by the information about actions of adversaries and defenders available to opponents (interdependence information) as well as by alerts from intrusion detection systems (IDSs), which offer recommendations to defenders against cyberattacks. Little is currently known, however, on how interdependence information and IDS alerts would influence the attack-and-defend decisions in cyber security. This paper discusses a laboratory experiment involving participants (N = 140) performing as would-be adversaries (attackers) and defenders (analysts). Participants were randomly assigned to four between-subjects conditions in a cyber security game, where the conditions varied in interdependence information (full-information or no-information) and IDS alerts (present or absent). Results revealed that the proportion of defend (attack) actions were smaller (same) when IDS was present compared to absent. In addition, the proportion of defend (attack) actions were same (smaller) in conditions of full-information about opponents compared to no-information about opponents. Furthermore, to understand the experimental results, the authors calibrated cognitive models based upon instance-based learning theory (IBLT), a theory of decisions from experience. Based upon the experimental conditions, four different variants of a single instance-based learning (IBL) model were developed. Model results revealed excessive reliance on recency and frequency of information and cognitive noise among both attackers and defenders across different experimental conditions. The paper highlights the implications of our results for cyber-decisions in the real world.

Online Mining Intrusion Patterns from IDS Alerts

The intrusion detection system (IDS) which is used widely in enterprises, has produced a large number of logs named alerts, from which the intrusion patterns can be mined. These patterns can be used to construct the intrusion scenarios or discover the final objectives of the malicious actors, and even assist the forensic works of network crimes. In this paper, a novel algorithm for the intrusion pattern mining is proposed which aimsto solve the difficult problems of the intrusion action sequence such as the loss of important intrusion actions, the disorder of the action sequence and the random noise actions. These common problems often occur in the real production environment which cause serious performance decrease in the analyzing system. The proposed algorithm is based on the online analysis of the intrusion action sequences extracted from IDS alerts, through calculating the influences of a particular action on the subsequent actions, the real intrusion patterns are discovered. The experimental results show that the method is effective in discovering pattern from the complex intrusion action sequences.

Miner Alerts Module To Generate Itemsets Based On FP-Growth Algorithm Improvement

Data mining techniques becomes very useful for all areas, Which gives impressive results and accurate. It is can be works with huge data and variance types data. The intrusion detection system (IDS) has huge numbers of alerts without classify and almost alerts be false positive. In this paper, we proposed a new miner module to generating Itemsets of IDS alerts by using FP-Growth Algorithm Improvement, which it is produce from compact Fp growth algorithm with Apriori algorithm. This a new module contains three phases; Compute support, Resort, and Generating K-Itemsets. Its applies on Darpa 1999 datasets to generating Alerts sets based on IDS Snort. The obtain result was very useful because it is make the alerts ready to classify.

TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor

Tor is a popular low-latency anonymous communication system. It is, however, currently abused in various ways. Tor exit routers are frequently troubled by administrative and legal complaints. To gain an insight into such abuse, we designed and implemented a novel system, TorWard, for the discovery and the systematic study of malicious traffic over Tor. The system can avoid legal and administrative complaints, and allows the investigation to be performed in a sensitive environment such as a university campus. An intrusion detection system (IDS) is used to discover and classify malicious traffic. We performed comprehensive analysis and extensive real-world experiments to validate the feasibility and the effectiveness of TorWard. Our results show that around 10% Tor traffic can trigger IDS alerts. Malicious traffic includes P2P traffic, malware traffic (e.g., botnet traffic), denial-of-service attack traffic, spam, and others. Around 200 known malwares have been identified. To mitigate the abuse of Tor, we implemented a defense system, which processes IDS alerts, tears down, and blocks suspect connections. To facilitate forensic traceback of malicious traffic, we implemented a dual-tone multi-frequency signaling-based approach to correlate botnet traffic at Tor entry routers and that at exit routers. We carried out theoretical analysis and extensive real-world experiments to validate the feasibility and the effectiveness of TorWard for discovery, blocking, and traceback of malicious traffic.

취약점 점검을 활용한 보안이벤트 검증 방법의 실증적 효과분석

인터넷상에서 발생하는 사이버위협이 폭발적으로 증가하고 있으며 해킹 기술 또한 지속적으로 진화함에 따라 이에 대응하기 위한 다양한 보안기술 및 시스템에 대한 연구가 진행되고 있다. 특히, 침입탐지시스템(Intrusion Detection System : IDS)은 사이버 공격에 대한 실시간 탐지 및 분석을 수행하기 위한 솔루션으로 대부분의 기관에서 구축 운용하고 있다. 하지만, IDS가 탐지하는 보안이벤트 수가 기하급수적으로 증가하고 있고 이들 대부분이 오탐(정상 통신을 공격으로 잘못 탐지)이기 때문에 모든 보안이벤트를 관제요원이 실시간으로 분석하기 힘들다는 문제점이 있다. 이에 IDS가 탐지한 대용량 보안이벤트를 실시간으로 분석하여 실제 해킹공격의 발생여부를 자동으로 검증하기 위한 연구가 주목을 받고 있다. 본 논문에서는 보호대상 정보시스템에 대한 취약점 점검결과와 대용량 보안이벤트와의 상관분석을 통해 실제 해킹공격의 발생여부를 자동으로 검증하기 위한 방법론을 제시한다. 또한, 실제 보안업무 현장에서 수집된 보안이벤트 정보와 취약점 점검결과를 활용하여 제안 방법론의 유효성을 도출하기 위한 실증적 실험을 수행한다. Cyber threats on the Internet are tremendously increasing and their techniques are also evolving constantly. Intrusion Detection System (IDS) is one of the powerful solutions for detecting and analyzing the cyber attacks in realtime. Most organizations deploy it into their networks and operate it for security monitoring and response service. However, IDS has a fatal problem in that it raises a large number of alerts and most of them are false positives. In order to cope with this problem, many approaches have been proposed for the purpose of automatically identifying whether the IDS alerts are caused by real attacks or not. In this paper, we present an alert verification method based on correlation analysis between vulnerability inspection results for real systems that should be protected and the IDS alerts. In addition, we carry out practical experiments to demonstrate the effectiveness of the proposed verification method using two types of real data, i.e., the IDS alerts and the vulnerability inspection results.

IDS Alert Correlation in the Wild With EDGe

Intrusion detection systems (IDSs) produce a large number of alerts, which overwhelm their operators, e.g., a deployment of the popular Snort IDS in the campus network of ETH Zurich (which includes more than 40 thousand hosts) produces on average 3 million alerts per day. In this paper, we introduce an IDS alert correlator, which we call Extrusion Detection Guard (EDGe), to detect infected hosts within a monitored network from IDS alerts. EDGe detects several malware that exhibit a multi-stage behavior and it can identify the family and even variant of certain malware, which helps to remediate and prioritize incidents. Our validation based on manual real-time analysis of a sample of detected incidents shows that only 15% of the detected infections are false positives. In addition, we compare EDGe with a state-of-the-art previous work and show that EDGe finds 60% more infections and has a lower number of false positives. A large part of this paper focuses on characterizing 4,358 infections (13.4 new infections per day) detected with EDGe from a unique dataset of 832 million IDS alerts collected from an operational network over a period of 9 months. Our characterization shows that infections exhibit spatial correlations and attract many further inbound attacks. Moreover, we investigate attack heavy hitters and show that client infections are significantly more bursty compared to server infections. Finally, we compare the alerts produced by different malware families and highlight key differences in their volume, aliveness, fanout, and severity.

An Entropy-based Method for Attack Detection in Large Scale Network

Intrusion Detection System (IDS) typically generates a huge number of alerts with high false rate, especially in the large scale network, which result in a huge challenge on the efficiency and accuracy of the network attack detection. In this paper, an entropy-based method is proposed to analyze the numerous IDS alerts and detect real network attacks. We use Shannon entropy to examine the distribution of the source IP address, destination IP address, source threat and destination threat and datagram length of IDS alerts; employ Renyi cross entropy to fuse the Shannon entropy vector to detect network attack. In the experiment, we deploy the Snort to monitor part of Xi’an Jiaotong University (XJTU) campus network including 32 C-class network (more than 4000 users), and gather more than 40,000 alerts per hour on average. The entropy-based method is employed to analyze those alerts and detect network attacks. The experiment result shows that our method can detect 96% attacks with very low false alert rate.

Improving the management of IDS alerts

Intrusion Detection Systems (IDSs) play very crucial role in minimizing the damage caused by different computer attacks. In fact, most IDSs are capable of detecting many attacks, but often appear problematic because of triggering huge number of non-interesting alerts which diminish the value and urgency of interesting alerts. The analysts who review the alerts rarely look at the voluminous alerts until a sign is reported by other security means because it is laborious and challenging task to identify the interesting alerts. This has led to the emergence of many approaches to manage the overwhelming number of alerts. The existing approaches suffer from several limitations. This paper conducts a comprehensive study and evaluation of the key approaches that aim to manage the huge number of alerts in order to identify some research gaps that will objectively motivate researchers to come up with better approaches. At the end of the review, this paper suggests a strategy that can be exploited in order to improve the quality of final alerts.

IDSRadar: a real-time visualization framework for IDS alerts

Intrusion Detection Systems (IDS) is an automated cyber security monitoring system to sense malicious activities. Unfortunately, IDS often generates both a considerable number of alerts and false positives in IDS logs. Information visualization allows users to discover and analyze large amounts of information through visual exploration and interaction efficiently. Even with the aid of visualization, identifying the attack patterns and recognizing the false positives from a great number of alerts are still challenges. In this paper, a novel visualization framework, IDSRadar, is proposed for IDS alerts, which can monitor the network and perceive the overall view of the security situation by using radial graph in real-time. IDSRadar utilizes five categories of entropy functions to quantitatively analyze the irregular behavioral patterns, and synthesizes interactions, filtering and drill-down to detect the potential intrusions. In conclusion, IDSRadar is used to analyze the mini-challenges of the VAST challenge 2011 and 2012.

RESEARCH PROPOSAL: AN INTRUSION DETECTION SYSTEM ALERT REDUCTION AND ASSESSMENT FRAMEWORK BASED ON DATA MINING

The Intrusion Detection System (IDS) generates huge amounts of alerts that are mostly false positives. The abundance of false positive alerts makes it difficult for the security analyst to identify successful attacks and to take remedial actions. Such alerts to have not been classified in accordance with their degree of threats. They further need to be processed to ascertain the most serious alerts and the time of the reaction response. They may take a long time and considerable space to discuss thoroughly. Each IDS generates a huge amount of alerts where most of them are real while the others are not (i.e., false alert) or are redundant alerts. The false alerts create a serious problem for intrusion detection systems. Alerts are defined based on source/destination IP and source/destination ports. However, one cannot know which of those IP/ports bring a threat to the network. The IDSs’ alerts are not classified depending on their degree of the threat. It is difficult for the security analyst to identify attacks and take remedial action for this threat. So it is necessary to assist in categorizing the degree of the threat, by using data mining techniques. The proposed framework for proposal is IDS Alert Reduction and Assessment Based on Data Mining (ARADMF). The proposed framework contains three systems: Traffic data retrieval and collection mechanism system, reduction IDS alert processes system and threat score process of IDS alert system. The traffic data retrieval and collection mechanism systems develops a mechanism to save IDS alerts, extract the standard features as intrusion detection message exchange format and save them in DB file (CSV-type). It contains the Intrusion Detection Message Exchange Format (IDMEF) which works as procurement alerts and field reduction is used as data standardization to make the format of alert as standard as possible. As for Feature Extraction (FE) system, it is designed to extract the features of alert by using a gain information algorithm, which gives a rank for every feature to facilitate the selection of the feature with the highest rank. The main function of reduction IDS alert processes system is to remove duplicate IDS alerts and reduces the amount of false alerts based on a new aggregation algorithm. It consists of three phases. The first phase removes redundant alerts. The second phase reduces false alerts based on threshold time value and the last phase reduces false alerts based on rules with a threshold common vulnerabilities and exposure value. Threat score process of IDS alert system is characterized by using a proposed adaptive Apriori algorithm, which has been modified to work with multi features, i.e., items and automated classification of alerts according to their threat’s scores. The expected result of his proposed will be decreasing the number of false positive alert with rate expected 90% and increasing the level of accuracy compared with other approaches. The reasons behind using ARADMF are to reduce the false IDS alerts and to assess them to examine the threat score of IDS alert, that is will be effort to increase the efficiency and accuracy of network security.

Alertwheel: radial bipartite graph visualization applied to intrusion detection system alerts

Intrusion detection systems, or IDSs, are network security tools that generate huge quantities of information which are challenging to analyze. Information visualization is essential for efficiently parsing these data to discover the underlying causes of computer security breaches. AlertWheel is a user interface featuring a novel radial overview visualization, as well as filtering, drilling down, and saving and annotating subsets of data, to support the workflow of real network defense analysts. In designing AlertWheel, we identified new ways of displaying bipartite graphs (i.e., network diagrams showing links between two sets of nodes). The links in AlertWheel's visualizations are positioned and shaped to avoid occlusion of data, and three different edge bundling techniques are used to reduce clutter.

Using Adaptive Neuro-Fuzzy Inference System in Alert Management of Intrusion Detection Systems

By ever increase in using computer network and internet, using Intrusion Detection Systems (IDS) has been more important. Main problems of IDS are the number of generated alerts, alert failure as well as identifying the attack type of alerts. In this paper a system is proposed that uses Adaptive Neuro-Fuzzy Inference System to classify IDS alerts reducing false positive alerts and also identifying attack types of true positive ones. By the experimental results on DARPA KDD cup 98, the system can classify alerts, leading a reduction of false positive alerts considerably and identifying attack types of alerts in low slice of time.

A New Attack Detection in Large Scale Network based on Entropy

Intrusion Detection System (IDS) typically generates a huge number of alerts with high false rate , especially in the large scale network, which result in a huge challenge on the efficiency and accuracy of the network attack detection . In this paper, an entropy-based method is proposed to analyze the numerous IDS alerts and detect real network attacks. We use Shannon entropy to examine the distribution of the source IP address, destination IP address, source threat and destination threat and datagram length of IDS alerts; employ Renyi cross entropy to fuse the Shannon entropy vector to detect network attack. In the experiment, we deploy the Snort to monitor part of Xi’an Jiaotong University (XJTU) campus network including 32 C-class network (more than 4000 users), and gather more than 40,000 alerts per hour on average. The entropy-based method is employed to analyze those alerts and detect network attacks. The experiment result shows that our method can detect 96% attacks with very low false alert rate.

Measuring IDS-estimated attack impacts for rational incident response: A decision theoretic approach

Intrusion detection system (IDS) plays a vital role in defending our cyberspace against attacks. Either misuse-based IDS or anomaly-based IDS, or their combinations, however, can only partially reflect the true system state due to excessive false alerts, low detection rate, and inaccurate incident diagnosis. An automated response component built upon IDS therefore must consider the stale and imperfect picture inferred from them and takes action accordingly. This article presents an approach for measuring attack impact with the evidence of IDS alerts, with the objective to suggest rational response by cost-benefit analysis. More specifically, based on a very realistic assumption that a system evolves as a Markov decision process conditioned upon the current system state, imperfect observation, and action, we use partially observable Markov decision process to model the efficacy of IDS as providing a probabilistic assessment of the state of system assets, and to maximize a reward signal (defined as a function of both cost and benefit) by taking appropriate actions in response to the estimated system states in terms of desirable security properties. The ultimate goal is to move the system to more secure states with respect to pre-specified security metrics, and assist system administrators to identify the best tradeoff between the cost and benefit of security policies. We finally use a benchmark data set to practically illustrate the application of our methodology and conduct a proof-of-concept validation on its feasibility and efficiency.

Projecting Cyberattacks Through Variable-Length Markov Models

Previous works in the area of network security have emphasized the creation of intrusion detection systems (IDSs) to flag malicious network traffic and computer usage, and the development of algorithms to analyze IDS alerts. One possible byproduct of correlating raw IDS data are attack tracks, which consist of ordered collections of alerts belonging to a single multistage attack. This paper presents a variable-length Markov model (VLMM) that captures the sequential properties of attack tracks, allowing for the prediction of likely future actions on ongoing attacks. The proposed approach is able to adapt to newly observed attack sequences without requiring specific network information. Simulation results are presented to demonstrate the performance of VLMM predictors and their adaptiveness to new attack scenarios.

Optimal IDS Sensor Placement and Alert Prioritization Using Attack Graphs

We optimally place intrusion detection system (IDS) sensors and prioritize IDS alerts using attack graph analysis. We begin by predicting all possible ways of penetrating a network to reach critical assets. The set of all such paths through the network constitutes an attack graph, which we aggregate according to underlying network regularities, reducing the complexity of analysis. We then place IDS sensors to cover the attack graph, using the fewest number of sensors. This minimizes the cost of sensors, including effort of deploying, configuring, and maintaining them, while maintaining complete coverage of potential attack paths. The sensor-placement problem we pose is an instance of the NP-hard minimum set cover problem. We solve this problem through an efficient greedy algorithm, which works well in practice. Once sensors are deployed and alerts are raised, our predictive attack graph allows us to prioritize alerts based on attack graph distance to critical assets.