An efficient intrusion alerts miner for forensics readiness in high speed networks

Aymen Akremi, Hassen Sallay, Mohsen Rouached

Research output: Contribution to journalArticlepeer-review

5 Citations (Scopus)


Intrusion Detection System is considered as a core tool in the collection of forensically relevant evidentiary data in real or near real time from the network. The emergence of High Speed Network (HSN) and Service oriented architecture/Web Services (SOA/WS) putted the IDS in face of a typical big data management problem. The log files that IDS generates are very enormous making very fastidious and both compute and memory intensive the forensics readiness process. Furthermore the high level rate of wrong alerts complicates the forensics expert alert analysis and it disproves its performance, efficiency and ability to select the best relevant evidences to attribute attacks to criminals. In this context, we propose Alert Miner (AM), an intrusion alert classifier, which classifies efficiently in near real-time the intrusion alerts in HSN for Web services. AM uses an outlier detection technique based on an adaptive deduced association rules set to classify the alerts automatically and without human assistance. AM reduces false positive alerts without losing high sensitivity (up to 95%) and accuracy up to (97%). Therefore AM facilitates the alert analysis process and allows the investigators to focus their analysis on the most critical alerts on near real-time scale and to postpone less critical alerts for an off-line log analysis.

Original languageEnglish
Pages (from-to)62-78
Number of pages17
JournalInternational Journal of Information Security and Privacy
Issue number1
Publication statusPublished - Jan 1 2014


  • Big data
  • Data mining
  • Forensics readiness
  • High Speed Network
  • Intrusion alert
  • Web services

ASJC Scopus subject areas

  • Information Systems


Dive into the research topics of 'An efficient intrusion alerts miner for forensics readiness in high speed networks'. Together they form a unique fingerprint.

Cite this