IDS false alarm filtering using KNN classifier

Kwok Ho Law; Lam For Kwok

doi:10.1007/978-3-540-31815-6_10

IDS false alarm filtering using KNN classifier

Kwok Ho Law
, Lam For Kwok

Department of Computer Science

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

39 Citations (Scopus)

Abstract

Intrusion detection is one of the important aspects in computer security. Many commercial intrusion detection systems (IDSs) are available and are widely used by organizations. However, most of them suffer from the problem of high false alarm rate, which added heavy workload to security officers who are responsible for handling the alarms. In this paper, we propose a new method to reduce the number of false alarms. We model the normal alarm patterns of IDSs and detect anomaly from incoming alarm streams using k-nearest-neighbor classifier. Preliminary experiments show that our approach successfully reduces up to 93% of false alarms generated by a famous IDS. © Springer-Verlag Berlin Heidelberg 2004.

Original language	English
Title of host publication	Information Security Applications
Subtitle of host publication	5th International Workshop, WISA 2004, Jeju Island, Korea, August 23-25, 2004, Revised Selected Papers
Editors	Chae Hoon Lim, Moti Yung
Publisher	Springer
Pages	114-121
ISBN (Electronic)	978-3-540-31815-6
ISBN (Print)	978-3-540-24015-0
DOIs	https://doi.org/10.1007/978-3-540-31815-6_10
Publication status	Published - 2005
Event	5th International Workshop on Information Security Applications (WISA 2004) - Jeju Island, Korea, Republic of Duration: 23 Aug 2004 → 25 Aug 2004

Publication series

Name	Lecture Notes in Computer Science
Volume	3325
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	5th International Workshop on Information Security Applications (WISA 2004)
Place	Korea, Republic of
City	Jeju Island
Period	23/08/04 → 25/08/04

Access Output

10.1007/978-3-540-31815-6_10

Other Access Options

Check CityUHK Library

Permanent Link

Right click to copy link

Cite this

Law, K. H., & Kwok, L. F. (2005). IDS false alarm filtering using KNN classifier. In C. H. Lim, & M. Yung (Eds.), Information Security Applications: 5th International Workshop, WISA 2004, Jeju Island, Korea, August 23-25, 2004, Revised Selected Papers (pp. 114-121). (Lecture Notes in Computer Science; Vol. 3325). Springer . https://doi.org/10.1007/978-3-540-31815-6_10

@inproceedings{75a5039d19a9404f8e3ed466beb20b49,

title = "IDS false alarm filtering using KNN classifier",

abstract = "Intrusion detection is one of the important aspects in computer security. Many commercial intrusion detection systems (IDSs) are available and are widely used by organizations. However, most of them suffer from the problem of high false alarm rate, which added heavy workload to security officers who are responsible for handling the alarms. In this paper, we propose a new method to reduce the number of false alarms. We model the normal alarm patterns of IDSs and detect anomaly from incoming alarm streams using k-nearest-neighbor classifier. Preliminary experiments show that our approach successfully reduces up to 93\% of false alarms generated by a famous IDS. {\textcopyright} Springer-Verlag Berlin Heidelberg 2004.",

author = "Law, \{Kwok Ho\} and Kwok, \{Lam For\}",

year = "2005",

doi = "10.1007/978-3-540-31815-6\_10",

language = "English",

isbn = "978-3-540-24015-0",

series = "Lecture Notes in Computer Science",

publisher = "Springer ",

pages = "114--121",

editor = "Lim, \{Chae Hoon\} and Moti Yung",

booktitle = "Information Security Applications",

note = "5th International Workshop on Information Security Applications (WISA 2004) ; Conference date: 23-08-2004 Through 25-08-2004",

}

Law, KH & Kwok, LF 2005, IDS false alarm filtering using KNN classifier. in CH Lim & M Yung (eds), Information Security Applications: 5th International Workshop, WISA 2004, Jeju Island, Korea, August 23-25, 2004, Revised Selected Papers. Lecture Notes in Computer Science, vol. 3325, Springer , pp. 114-121, 5th International Workshop on Information Security Applications (WISA 2004), Jeju Island, Korea, Republic of, 23/08/04. https://doi.org/10.1007/978-3-540-31815-6_10

IDS false alarm filtering using KNN classifier. / Law, Kwok Ho; Kwok, Lam For.
Information Security Applications: 5th International Workshop, WISA 2004, Jeju Island, Korea, August 23-25, 2004, Revised Selected Papers. ed. / Chae Hoon Lim; Moti Yung. Springer , 2005. p. 114-121 (Lecture Notes in Computer Science; Vol. 3325).

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

TY - GEN

T1 - IDS false alarm filtering using KNN classifier

AU - Law, Kwok Ho

AU - Kwok, Lam For

PY - 2005

Y1 - 2005

N2 - Intrusion detection is one of the important aspects in computer security. Many commercial intrusion detection systems (IDSs) are available and are widely used by organizations. However, most of them suffer from the problem of high false alarm rate, which added heavy workload to security officers who are responsible for handling the alarms. In this paper, we propose a new method to reduce the number of false alarms. We model the normal alarm patterns of IDSs and detect anomaly from incoming alarm streams using k-nearest-neighbor classifier. Preliminary experiments show that our approach successfully reduces up to 93% of false alarms generated by a famous IDS. © Springer-Verlag Berlin Heidelberg 2004.

AB - Intrusion detection is one of the important aspects in computer security. Many commercial intrusion detection systems (IDSs) are available and are widely used by organizations. However, most of them suffer from the problem of high false alarm rate, which added heavy workload to security officers who are responsible for handling the alarms. In this paper, we propose a new method to reduce the number of false alarms. We model the normal alarm patterns of IDSs and detect anomaly from incoming alarm streams using k-nearest-neighbor classifier. Preliminary experiments show that our approach successfully reduces up to 93% of false alarms generated by a famous IDS. © Springer-Verlag Berlin Heidelberg 2004.

UR - https://www.scopus.com/pages/publications/23944484457

UR - https://www.scopus.com/pages/publications/23944484457#tab=impact

U2 - 10.1007/978-3-540-31815-6_10

DO - 10.1007/978-3-540-31815-6_10

M3 - RGC 32 - Refereed conference paper (with host publication)

SN - 978-3-540-24015-0

T3 - Lecture Notes in Computer Science

SP - 114

EP - 121

BT - Information Security Applications

A2 - Lim, Chae Hoon

A2 - Yung, Moti

PB - Springer

T2 - 5th International Workshop on Information Security Applications (WISA 2004)

Y2 - 23 August 2004 through 25 August 2004

ER -

IDS false alarm filtering using KNN classifier

Abstract

Publication series

Conference

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

Cite this