False alarm minimization techniques in signature-based intrusion detection systems: A survey

N Hubballi, V Suryanarayanan - Computer Communications, 2014 - Elsevier
A network based Intrusion Detection System (IDS) gathers and analyzes network packets
and report possible low level security violations to a system administrator. In a large network …

A systematic survey on multi-step attack detection

J Navarro, A Deruyver, P Parrend - Computers & Security, 2018 - Elsevier
Since the beginning of the Internet, cyberattacks have threatened users and organisations.
They have become more complex concurrently with computer networks. Nowadays …

Danger theory: The link between AIS and IDS?

U Aickelin, P Bentley, S Cayzer, J Kim… - Artificial Immune Systems …, 2003 - Springer
We present ideas about creating a next generation Intrusion Detection System (IDS) based
on the latest immunological theories. The central challenge with computer security is …

Data mining and machine learning—towards reducing false positives in intrusion detection

T Pietraszek, A Tanner - Information security technical report, 2005 - Elsevier
Intrusion Detection Systems (IDSs) are used to monitor computer systems for signs of
security violations. Having detected such signs, IDSs trigger alerts to report them. These …

Artificial immune systems

U Aickelin, D Dasgupta, F Gu - Search Methodologies: Introductory …, 2013 - Springer
The biological immune system is a robust, complex, adaptive system that defends the body
from foreign pathogens. It is able to categorize all cells (or molecules) within the body as self …

Log correlation for intrusion detection: A proof of concept

C Abad, J Taylor, C Sengul, W Yurcik… - 19th Annual …, 2003 - ieeexplore.ieee.org
Intrusion detection is an important part of networked-systems security protection. Although
commercial products exist, finding intrusions has proven to be a difficult task with limitations …

Alert correlation algorithms: A survey and taxonomy

SA Mirheidari, S Arshad, R Jalili - … , November 13-15, 2013, Proceedings 5, 2013 - Springer
Alert correlation is a system which receives alerts from heterogeneous Intrusion Detection
Systems and reduces false alerts, detects high level patterns of attacks, increases the …

Modeling network intrusion detection alerts for correlation

J Zhou, M Heckman, B Reynolds, A Carlson… - ACM Transactions on …, 2007 - dl.acm.org
Signature-based network intrusion-detection systems (NIDSs) often report a massive
number of simple alerts of low-level security-related events. Many of these alerts are …

Efficient attack graph analysis through approximate inference

L Munoz-Gonzalez, D Sgandurra, A Paudice… - ACM Transactions on …, 2017 - dl.acm.org
Attack graphs provide compact representations of the attack paths an attacker can follow to
compromise network resources from the analysis of network vulnerabilities and topology …

Systematic review and quantitative comparison of cyberattack scenario detection and projection

I Kovačević, S Groš, K Slovenec - Electronics, 2020 - mdpi.com
Intrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in
order to detect malicious activity and policy violations. Because IDSs have a large number of …