Alarm management for intrusion detection systems - Prioritizing and presenting alarms from intrusion detection systems
Year: 2012
Type: dissertation
Abstract: Intrusion detection systems (IDSs) are important tools helping the network and\nsystem administrators to detect intrusions, but have the drawback of many false\npositives. Due to increasing bandwidth, an IDS must process a vast amount of\ndata, which results in an ever increasing amount of alarms. For a system administrator\nto be able to handle the alarms they must be aggregated, correlated\nand ordered into a manageable form and presented in a way which is easy to\noverview.\nIn this thesis we study aggregation, correlation, filtering and ranking as methods\nfor managing alarms from IDSs. We have implemented a ranking functionality\nin the graphical user interface Snorby, a front end to the open source IDS Snort.\nEach alarm starts with a basic rank of 0 and the user is able to prioritize or\ndown prioritize the alarm by pressing either a ’+’ button or a ’-’ button, thus\ninfluencing its current rank. The rank is calculated from several features, i.e.\nsource IP, destination IP, destination port and alarm signature.\nBased on our studies we suggest that ranking systems supported by user votes\nhave several advantages. First, they allow the user to dynamically change the\nway the IDS lists the alarms through a very simple means. Second, it shortens\nthe time required to locate the more important ones, thus reducing the likelihood\nthat a serious attack will be missed.
Authors: Sebastian Klüft, Eva Lina Staaf
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W592112058