Semi-Supervised Classification and its Application to Filtering IDS False Positives

Abstract:

Alert classifiers built with the supervised classification technique require large amounts of labeled training alerts. Preparing for such training data is very difficult and expensive. Thus accuracy and feasibility of current classifiers are greatly restricted. This paper employs semi-supervised learning to build alert classification model to reduce the number of needed labeled training alerts. Alert context properties are also introduced to improve the classification performance. Experiments have demonstrated the accuracy and feasibility of our approach.

• Periodical: Applied Mechanics and Materials (Volumes 427-429)
• Pages: 2309-2312
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.427-429.2309
• Online since: September 2013
• Authors: Hai Bin Mei*, Ming Hua Zhang
• Keywords: False Positive, IDS, Semi-Supervised Classification

References

[1] F. Xiao, S. Jin, and X. Li, A novel data mining-based method for alert reduction and analysis, Journal of networks, vol. 5, no. 1 pp.88-97, (2010).

[2] H. Debar and A. Wespi, Aggregation and correlation of intrusion detection alerts, in Proc. of the 4th Int. Symposium on Recent Advances in Intrusion Detection, pp.85-103, (2001).

DOI: 10.1007/3-540-45474-8_6

[3] P. Ning, Y. Cui, D. S. Reeves, and X. Dingbang, Techniques and tools for analyzing intrusion alerts, ACM Transactions on Information and System Security, vol. 7, no. 2 pp.274-318, (2004).

DOI: 10.1145/996943.996947

[4] T. Pietraszek, Using adaptive alert classification to reduce false positives in intrusion detection, in Proc. of the 7th Int. Symposium on Recent Advances in Intrusion Detection, pp.102-124, (2004).

DOI: 10.1007/978-3-540-30143-1_6

[5] T. Subbulakshmi, G. Mathew, and S. M. Shalinie, Real time classification and clustering of IDS alerts using machine learning algorithms, International Journal of Artificial Intelligence & Application(IJAIA), vol. 1, no. 1 pp.1-9, (2010).

[6] M. S. Shin, E. H. Kim, and K. H. Ryu, False alarm classification model for network-based intrusion detection system, in Proc. of the 5th Int. Conf. on Intelligent Data Engineering and Automated Learning, pp.259-265, (2004).

DOI: 10.1007/978-3-540-28651-6_38

[7] O. Chapelle, B. Scholkopf, and A. Zien, Semi-supervised learning,. Cambridge: MIT Press, (2006).

DOI: 10.7551/mitpress/9780262033589.001.0001

[8] H. Liu and L. Yu, Toward integrating feature selection algorithms for classification and cluster, IEEE Transactions on Knowledge and Data Engineering, vol. 17, no. 3 pp.491-502, (2005).

DOI: 10.1109/tkde.2005.66

[9] B. Morin, L. Mé, H. Debar, and M. Ducassé, M2D2: A formal data model for IDS alert correlation, in Proc. of the 5th Int. Symposium on Recent Advances in Intrusion Detection, pp.115-137, (2002).

DOI: 10.1007/3-540-36084-0_7

[10] B. Zhu and A. A. Ghorbani, Alert correlation for extracting attack strategies, International Journal of Network Security, vol. 3, no. 3 pp.244-258, (2006).

[11] K. Nigam, Using unlabeled data to improve text classification, PhD Thesis, Carnegie Mellon University, Pittsburgh, PA, USA, (2001).

[12] R. Lippmann, J. W. Haines, D. J. Fried, J. Korba, and K. Das, The 1999 DARPA off-line intrusion detection evaluation, Computer Networks, vol. 34, no. 4 pp.579-595, (2000).

DOI: 10.1016/s1389-1286(00)00139-0