文章基本信息

标题：Efficient Security Alert Management System
作者：Mr. Minoo Deljavan Anvary ; Mr. Majid Ghonji Feshki ; Mr. Amir Azimi Alasti Ahrabi 等
期刊名称：International Journal of Computer Science and Security (IJCSS)
电子版ISSN：1985-1553
出版年度：2015
卷号：9
期号：4
页码：218-224
出版社：Computer Science Journals
摘要：Nowadays there are several security tools that used to protect computer systems, computer networks, smart devices and etc. against attackers. Intrusion detection system is one of tools used to detect attacks. Intrusion Detection Systems produces large amount of alerts, security experts could not investigate important alerts, also many of that alerts are incorrect or false positives. Alert management systems are set of approaches that used to solve this problem. In this paper a new alert management system is presented. It uses K-nearest neighbor as a core component of the system that classify generated alerts. The suggested system serves precise results against huge amount of generated alerts. Because of low classification time per each alert, the system also could be used in online systems.
关键词：Intrusion Detection; Security Alert Management; K-nearest Neighbor; Real-time Security Alert Classification; Reduction of False Positive Alerts; Precise Classifying True Positive Alerts.