FuzMet: a fuzzy‐logic based alert prioritization engine for intrusion detection systems
FuzMet: a fuzzy‐logic based alert prioritization engine for intrusion detection systems
复制标题
FuzMet：用于入侵检测系统的基于模糊逻辑的警报优先级引擎
DOI：
--
复制
发表时间：
2012
影响因子：
1.5
通讯作者：
R. Boutaba
中科院分区：
文献类型：
--
作者：
Khalid Alsubhi;I. Aib;R. Boutaba
入侵检测系统 (IDS) 旨在监视网络环境并在检测到异常活动时生成警报。这些警报的数量可能非常大，这使得安全分析师对其进行评估成为一项艰巨的任务。由于需要配置警报评估系统的不同组件，管理变得复杂。此外，IDS 警报管理技术（例如集群和关联）会在其流程中涉及不相关的警报，从而提供不准确且难以管理的结果。因此，调整 IDS 警报管理系统以提供最佳结果仍然是一项重大挑战，而系统可能遭受的大量潜在攻击则使这一挑战变得更加复杂。本文考虑了 FuzMet 的规范和配置问题，FuzMet 是一种新颖的 IDS 警报管理系统，它采用多个指标和基于模糊逻辑的方法来对警报进行评分和优先级排序。此外，它还具有警报重新评分技术，可进一步减少警报数量。介绍了 SNORT 分数和 FuzMet 警报优先级在真实攻击数据集上的比较结果，以及对 FuzMet 最佳配置的基于模拟的研究。结果证明我们的系统带来了增强的入侵检测精度。版权所有 © 2011 约翰·威利父子有限公司
Intrusion detection systems (IDSs) are designed to monitor a networked environment and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large, making their evaluation by security analysts a difficult task. Management is complicated by the need to configure the different components of alert evaluation systems. In addition, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide results that are inaccurate and difficult to manage. Thus the tuning of an IDS alert management system in order to provide optimal results remains a major challenge, which is further complicated by the large spectrum of potential attacks the system can be subject to. This paper considers the specification and configuration issues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy‐logic based approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique that leads to a further reduction in the number of alerts. Comparative results between SNORT scores and FuzMet alert prioritization onto a real attack dataset are presented, along with a simulation‐based investigation of the optimal configuration of FuzMet. The results prove the enhanced intrusion detection accuracy brought by our system. Copyright © 2011 John Wiley & Sons, Ltd.