FuzMet: a fuzzy-logic based alert prioritization engine for intrusiondetection systems

摘要

Intrusion detection systems (IDSs) are designed to monitor a networked environment and generate alertsnwhenever abnormal activities are detected. The number of these alerts can be very large, making their evaluationnby security analysts a difficult task. Management is complicated by the need to configure the differentncomponents of alert evaluation systems. In addition, IDS alert management techniques, such as clusteringnand correlation, suffer from involving unrelated alerts in their processes and consequently provide resultsnthat are inaccurate and difficult to manage. Thus the tuning of an IDS alert management system in ordernto provide optimal results remains a major challenge, which is further complicated by the large spectrumnof potential attacks the system can be subject to. This paper considers the specification and configurationnissues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy-logicnbased approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique thatnleads to a further reduction in the number of alerts. Comparative results between SNORT scores andnFuzMet alert prioritization onto a real attack dataset are presented, along with a simulation-based investigationnof the optimal configuration of FuzMet. The results prove the enhanced intrusion detection accuracynbrought by our system