An efficient intrusion alerts miner for forensics readiness in high speed networks

Aymen Akremi, Hassen Sallay, Mohsen Rouached

نتاج البحث: المساهمة في مجلةArticleمراجعة النظراء

5 اقتباسات (Scopus)

ملخص

Intrusion Detection System is considered as a core tool in the collection of forensically relevant evidentiary data in real or near real time from the network. The emergence of High Speed Network (HSN) and Service oriented architecture/Web Services (SOA/WS) putted the IDS in face of a typical big data management problem. The log files that IDS generates are very enormous making very fastidious and both compute and memory intensive the forensics readiness process. Furthermore the high level rate of wrong alerts complicates the forensics expert alert analysis and it disproves its performance, efficiency and ability to select the best relevant evidences to attribute attacks to criminals. In this context, we propose Alert Miner (AM), an intrusion alert classifier, which classifies efficiently in near real-time the intrusion alerts in HSN for Web services. AM uses an outlier detection technique based on an adaptive deduced association rules set to classify the alerts automatically and without human assistance. AM reduces false positive alerts without losing high sensitivity (up to 95%) and accuracy up to (97%). Therefore AM facilitates the alert analysis process and allows the investigators to focus their analysis on the most critical alerts on near real-time scale and to postpone less critical alerts for an off-line log analysis.

اللغة الأصليةEnglish
الصفحات (من إلى)62-78
عدد الصفحات17
دوريةInternational Journal of Information Security and Privacy
مستوى الصوت8
رقم الإصدار1
المعرِّفات الرقمية للأشياء
حالة النشرPublished - يناير 1 2014
منشور خارجيًانعم

ASJC Scopus subject areas

  • ???subjectarea.asjc.1700.1710???

بصمة

أدرس بدقة موضوعات البحث “An efficient intrusion alerts miner for forensics readiness in high speed networks'. فهما يشكلان معًا بصمة فريدة.

قم بذكر هذا