標題: Creditability-based weighted voting for reducing false positives and negatives in intrusion detection
作者: Lin, Ying-Dar
Lai, Yuan-Cheng
Ho, Cheng-Yuan
Tai, Wei-Hsuan
資訊工程學系
Department of Computer Science
關鍵字: Intrusion detection;False positives/negatives;Weighted voting;Majority voting;Creditability
公開日期: 1-十一月-2013
摘要: False positives (FPs) and false negatives (FNs) happen in every Intrusion Detection System (IDS). How often they occur is regarded as a measurement of the accuracy of the system. Frequent occurrences of FPs not only reduce the throughput of an IDS as FPs block the normal traffic and also degrade its trustworthiness. It is also difficult to eradicate all FNs from an IDS. One way to overcome the shortcomings of a single IDS is to employ multiple IDSs in its place and leverage the different capabilities and domain knowledge of these systems. Nonetheless, making a correct intrusion decision based on the outcomes of multiple IDSs has been a challenging task, as different IDSs may respond differently to the same packet trace. In this paper, we propose a method to reduce FPs and FNs by applying a creditability-based weighted voting (CWV) scheme to the outcomes of multiple IDSs. First, the CWV scheme evaluates the creditability of each individual IDS by monitoring its response to a large collection of pre-recorded packet traces containing various types of intrusions. For each IDS, our scheme then assigns different weights to each intrusion type according to its FP and FN ratios. Later, after their operations, the outcomes of individual IDSs are merged using a weighted voting scheme. In benchmarking tests, our CWV-based multiple IDSs demonstrated significant improvement in accuracy and efficiency when compared with multiple IDSs employing an ordinary majority voting (MV) scheme. The accuracy is the percentage of whole traces that are determined accurately, while the efficiency indicates that the voting algorithm performs better on reducing both FP and FN ratios. The CWV scheme achieved 95% accuracy and 94% efficiency while the MV scheme produced only 66% accuracy and 41% efficiency; the average percentages of FP/FN reduction were 21% and 58% respectively. (C) 2013 Elsevier Ltd. All rights reserved.
URI: http://dx.doi.org/10.1016/j.cose.2013.09.010
http://hdl.handle.net/11536/23461
ISSN: 0167-4048
DOI: 10.1016/j.cose.2013.09.010
期刊: COMPUTERS & SECURITY
Volume: 39
Issue: 
起始頁: 460
結束頁: 474
顯示於類別:期刊論文


文件中的檔案:

  1. 000329007400026.pdf

若為 zip 檔案,請下載檔案解壓縮後,用瀏覽器開啟資料夾中的 index.html 瀏覽全文。