Sciweavers

Share
ACMSE
2005
ACM

Alert confidence fusion in intrusion detection systems with extended Dempster-Shafer theory

10 years 3 months ago
Alert confidence fusion in intrusion detection systems with extended Dempster-Shafer theory
Accurate identification of misuse is a key factor in determining appropriate ways to protect systems. Modern intrusion detection systems often use alerts from different sources such as hosts and sub-networks to determine whether and how to respond to an attack. However, alerts from different locations should not be treated equally. We propose improving and assessing alert accuracy by incorporating an algorithm based on the exponentially weighted Dempster-Shafer (D-S) Theory of Evidence. Our approach uses D-S theory to combine beliefs in certain hypotheses under conditions of uncertainty and ignorance, and allows quantitative measurement of the belief and plausibility in our detection results. Our initial evaluations on the DARPA IDS evaluation data set show that our alert fusion algorithm can improve alert quality over those from Hidden Colored Petri-Net (HCPN) based alert correlation components installed at the demilitarized zone (DMZ) and inside network sites. Due to alert confidenc...
Dong Yu, Deborah A. Frincke
Added 26 Jun 2010
Updated 26 Jun 2010
Type Conference
Year 2005
Where ACMSE
Authors Dong Yu, Deborah A. Frincke
Comments (0)
books