A model for anomaly classification in intrusion detection systems

Autor:	V O Ferreira, V V Galhardi, Leandro Bertini Lara Goncalves, R C Silva, Adriano Mauro Cansian
Rok vydání:	2015
Předmět:	History Anomaly-based intrusion detection system Anomaly (natural sciences) Context (language use) Intrusion detection system computer.software_genre Misuse detection Computer Science Applications Education Geography One-class classification Anomaly detection Data mining computer
Zdroj:	Journal of Physics: Conference Series. 633:012124
ISSN:	1742-6596 1742-6588
DOI:	10.1088/1742-6596/633/1/012124
Popis:	Intrusion Detection Systems (IDS) are traditionally divided into two types according to the detection methods they employ, namely (i) misuse detection and (ii) anomaly detection. Anomaly detection has been widely used and its main advantage is the ability to detect new attacks. However, the analysis of anomalies generated can become expensive, since they often have no clear information about the malicious events they represent. In this context, this paper presents a model for automated classification of alerts generated by an anomaly based IDS. The main goal is either the classification of the detected anomalies in well-defined taxonomies of attacks or to identify whether it is a false positive misclassified by the IDS. Some common attacks to computer networks were considered and we achieved important results that can equip security analysts with best resources for their analyses.
Databáze:	OpenAIRE
Externí odkaz:	https://explore.openaire.eu/search/publication?articleId=doi_________::f88f1d2eeabc2543ace410b77473362c https://doi.org/10.1088/1742-6596/633/1/012124 Zobrazit plný text záznamu