Growing hierarchical self-organizing map for filtering intrusion detection alarms

الموضوعات

علوم تطبيقية وتكنولوجية

الملخص

A Network Intrusion Detection System (NIDS) is an alarm system for networks. NID Smonitors all inbound and outbound network actions and generates alarms when it detects suspicious or malicious attempts. A false positive alarm is generated when the NIDS misclassifies a normal action in the network as an attack. We present a data mining technique to assist network administrators to analyze and reduce false positive alarms that are produced by a NIDS. Our data mining technique is based on a Growing HierarchicalSelf-Organizing Map (GHSOM) that adjusts its architecture during an unsupervised training process according to the characteristics of the input alarm data, where no prior information is available about these alarms. GHSOM clusters these alarms in a way that supports network administrators in making decisions about true and false alarms. We compare the effectiveness of our GHSOM-based technique with a recent technique(SOM) using real-world intrusion detection data. The results show that our technique performs better than SOM in terms of reducing false positives from 15% to 4.7% and false negatives from16% to 4%.

روابط وملفات

التعريف والنوع

رقم الوثيقة

0a8bba38-6ae0-466c-a240-27dbca01e85b

رقم العقد

0

نوع الوسائط

Crawler

نوع المحتوى

الرسائل العلمية

صيغة المصدر

رسائل ماجيستير

نوع الملف

pdf text

أسماء الملفات

2213846_1.pdf

بيانات النشر

ألقاب المؤلفين

[{"name_ar":"Maya Shehab","title_ar":"اعداد","title_en":"Preparation"},{"name_ar":"Nashaat Mansour","title_ar":"اشراف","title_en":"Supervision"}]

اللغة

English

المصدر والدورية

اسم المصدر

Growing hierarchical self-organizing map for filtering intrusion detection alarms

المحتوى والصفحات

عدد الصفحات

0

كلمات الباحثين

self-organizing map

إشراف وإعداد

الإشراف

Nashaat Mansour

الإعداد

Maya Shehab

الاقتباسات الببليوغرافية