|
UWSpace >
University of Waterloo >
Electronic Theses and Dissertations (UW) >
Please use this identifier to cite or link to this item:
http://hdl.handle.net/10012/3479
|
| Title: | A Fuzzy-logic based Alert Prioritization Engine for IDSs: Architecture and Configuration |
| Authors: | Alsubhi, Khalid |
| Keywords: | Security
Intrusion detection
alert management
IDS |
| Approved Date: | 16-Jan-2008 |
| Date Submitted: | 2008 |
| Abstract: | Intrusion Detection Systems (IDSs) are designed to monitor a networked environment and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large making their evaluation by security analysts a difficult task. The management is complicated by the need to configure the different components of alert evaluation systems. In addition, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide results that are inaccurate and difficult to manage. Thus, the tuning of an IDS alert management system in order to provide optimal results remains a major challenge, which is further complicated by the large spectrum of potential attacks the system can be subject to.
This thesis considers the specification and configuration issues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy-logic based approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique that leads to a further reduction of the number of alerts. We study the impact of different configurations of the proposed metrics on the accuracy and completeness of the alert scores generated by FuzMet. Our approach is validated using the 2000 DARPA intrusion detection scenario specific datasets and comparative results between the Snort IDS alert scoring and FuzMet alert prioritization scheme are presented. A considerable number of simulations were conducted in order to determine the optimal configuration of FuzMet with selected simulation results presented and analyzed. |
| Program: | Computer Science |
| Department: | School of Computer Science |
| Degree: | Master of Mathematics |
| URI: | http://hdl.handle.net/10012/3479 |
| Appears in Collections: | Electronic Theses and Dissertations (UW)
Faculty of Mathematics Theses and Dissertations
|
This item is protected by original copyright
|
All items in UWSpace are protected by copyright, with all rights reserved.
|
