Improving anomaly-based nids alarms based on alarm classification approach

Qais Saif Qassim (P51684)

Please use this identifier to cite or link to this item: https://ptsldigital.ukm.my/jspui/handle/123456789/513241

Full metadata record

DC Field	Value	Language
dc.contributor.advisor	Ahmed Patel, Prof. Dr.
dc.contributor.author	Qais Saif Qassim (P51684)
dc.date.accessioned	2023-10-16T04:34:57Z	-
dc.date.available	2023-10-16T04:34:57Z	-
dc.date.issued	2016-06-21
dc.identifier.other	ukmvital:83269
dc.identifier.uri	https://ptsldigital.ukm.my/jspui/handle/123456789/513241	-
dc.description	There has been a great deal of research done in the past in the field of anomaly-based intrusion detection systems, where numerous detection techniques have been proposed. However, the majority of the proposed techniques face a number of challenges. One of the most significant challenges is the high rates of false positive alarms that have been generated. A detection system may incorrectly identify a legitimate non-intrusive normal activity as being malicious and eventually results in obstruction of legitimate traffic. With large amount of false positives generated, the real threats detected can often go unnoticed as the flood of alarms gets too high. This compromises the whole intrusion detection system reducing its security value to almost none, and in worst cases, high positive false alarms lead to self denial of service. Therefore, false alarms are a grave concern as it can severely impact the information resources. The primary objective of this research is to propose a new false alarm validation method for anomaly-based network intrusion detection systems to filter-out false positive alarms. In order to achieve the research objective, the research is carried out through a number of phases. In the first phase, network traffic features have been analysed to determine the best of features that represent the state of the environment to be examined. The next phase involves the development of the new alarm classification method, followed by the design and implementation of a prototype based on the proposed method. Finally the prototype is evaluated to determine its accuracy and performance. The result of this research is a new alarm validation system that helps to classify alarms without using predefined knowledge of attack signatures. The proposed system had been benchmarked using DARPA/MIT Lincoln Laboratory off-line intrusion detection evaluation dataset against Packet Header Anomaly Detection (PHAD). Experimental results showed that, the approach effectively reduces the amount of false alarms up to 80% on average. The results show that the selection of features and the proposed classification algorithm have a strong potential to detect alarm anomalies and significantly reduce the positive false alarms rate. To the best of our knowledge, it is the first time the false alarm patterns have been utilized in any sense to classify anomaly-based IDS alarms.,Certification of Master's/Doctoral Thesis" is not available
dc.language.iso	eng
dc.publisher	UKM, Bangi
dc.relation	Faculty of Information Science and Technology / Fakulti Teknologi dan Sains Maklumat
dc.rights	UKM
dc.subject	Detection systems
dc.subject	Alarm classification
dc.subject	False alarms
dc.subject	Information resources
dc.subject	Dissertations, Academic -- Malaysia
dc.title	Improving anomaly-based nids alarms based on alarm classification approach
dc.type	Theses
dc.format.pages	309
Appears in Collections:	Faculty of Information Science and Technology / Fakulti Teknologi dan Sains Maklumat

Files in This Item:

File	Description	Size	Format
ukmvital_83269+SOURCE1+SOURCE1.0.PDF Restricted Access		193.54 kB	Adobe PDF	View/Open

Show simple item record Recommend this item