Reducing False Positives Of Network Anomaly Detection By Local Adaptive Multivariate Smoothing
Journal of Computer and System Sciences(2017)
摘要
Network intrusion detection systems based on the anomaly detection paradigm have high false alarm rate making them difficult to use. To address this weakness, we propose to smooth the outputs of anomaly detectors by online Local Adaptive Multivariate Smoothing (LAMS). LAMS can reduce a large portion of false positives introduced by the anomaly detection by replacing the anomaly detector's output on a network event with an aggregate of its output on all similar network events observed previously. The arguments are supported by extensive experimental evaluation involving several anomaly detectors in two domains: NetFlow and proxy logs. Finally, we show how the proposed solution can be efficiently implemented to process large streams of non-stationary data. (C) 2016 Elsevier Inc. All rights reserved.
更多查看译文
关键词
Network anomaly detection,Regression smoothing,False positive rate reduction
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络