Enhancing intrusion detection systems using intelligent false alarm filter: Selecting the best machine learning algorithm

Intrusion Detection Systems (IDSs) have been widely implemented in various network environments asan essential component for current Information and Communications Technologies (ICT). However,false alarms are a big problem for these systems, in which a large number of IDS alarms, especiallyfalse positives, could be generated during their detection. This issue greatly decreases the effectivenessand the efficiency of an IDS and heavily increases the burden on analyzing real alarms. To mitigate thisproblem, in this chapter, the authors identify and analyze the reasons for causing this problem, presenta survey through reviewing some related work in the aspect of false alarm reduction, and introducea promising solution of constructing an intelligent false alarm filter to refine false alarms for an IDS.