Skip to the content

Hybrid rule threshold adjustment system for intrusion detection

Moghimi, M and Saraee, MH 2011, Hybrid rule threshold adjustment system for intrusion detection , in: The 8th International ISC Conference on Information Security and Cryptology (ISCISC 2011), September 14-15, 2011 - Ferdowsi University of Mashhad,, September 14-15, 2011, Mashhad, Iran.

[img] PDF - Published Version
Restricted to Repository staff only

Download (1MB) | Request a copy

Abstract

Generally, multiple IDSs generates huge volume of alerts every minute and to manage these alerts, rule-based alert management systems are very important. It is critical to keep the rules inside these systems updated, based on the ever changing network environment. Rule Threshold Adjustment is the solution to this problem and it is able to keep the rules updated. Rule Threshold Adjustment tunes the internal thresholds and keeps the structure unchanged. In this paper, we propose a hybrid threshold Adjustment framework by combining both the online and offline adjustment module together. This hybrid adjustment will be more robust and efficient in adjustment the threshold in real time and to keep the threshold fine-adjusted. The online module should work in real time to adjust the thresholds, whereas the offline module will be using some parts of the recent alerts to adjust the thresholds. We have implemented this method and evaluated it using real-world datasets. Our approach was successfully able to adjust the rules in all the cases with marginal error

Item Type: Conference or Workshop Item (Paper)
Themes: Media, Digital Technology and the Creative Economy
Schools: Schools > School of Computing, Science and Engineering
Schools > School of Computing, Science and Engineering > Salford Innovation Research Centre (SIRC)
Journal or Publication Title: ”, Proceedings of The 8th International ISC Conference on Information Security and Cryptology (ISCISC 2011),
Publisher: IEEE
Refereed: Yes
Related URLs:
Funders: Sepehr S. T. Co. Ltd, Tehran, Iran
Depositing User: Dr Mo Saraee
Date Deposited: 30 Aug 2013 16:33
Last Modified: 30 Nov 2015 23:55
URI: http://usir.salford.ac.uk/id/eprint/29447

Actions (login required)

Edit record (repository staff only) Edit record (repository staff only)

Downloads

Downloads per month over past year