A Case Study of Intelligent IDS False Alarm Reduction in Cloud Environments: Challenges and Trends

Intrusion detection systems (IDSs) have been widely deployed in computer networks and have proven their capability in detecting various attacks. However, false alarms are a big challenge for these systems, which can greatly decrease the effectiveness of detection and significantly increase the burden of analyzing IDS alarms. To mitigate this issue, one promising way is to construct an intelligent false alarm filter for an IDS that selects an appropriate machine learning algorithm in an adaptive way. But one of the potential problems is the workload of conducting adaptive classifier selection. With the advent of cloud computing, now it is feasible to offload the workload of evaluating different machine learning classifiers to a cloud environment. In this chapter, we therefore mainly conduct a case study to describe the implementation of an intelligent false alarm filter in a cloud environment. In addition, we further summarize several major challenges and point out future trends regarding intelligent false alarm reduction in clouds.