APHRODITE: an Anomaly-based Architecture for False Positive Reduction

2006/04/07 by Damiano Bolzoni, Bolzoni, Damiano, Sandro Etalle +1
Computer Science · #Anomaly Detection Techniques and Applications #Internet Traffic Analysis and Secure E-voting #Network Security and Intrusion Detection #cs.CR

paper · pdf · doi:10.48550/arxiv.cs/0604026

arxiv created 2006/04/07 · arxiv updated 2009/12/01

Abstract

We present APHRODITE, an architecture designed to reduce false positives in network intrusion detection systems. APHRODITE works by detecting anomalies in the output traffic, and by correlating them with the alerts raised by the NIDS working on the input traffic. Benchmarks show a substantial reduction of false positives and that APHRODITE is effective also after a "quick setup", i.e. in the realistic case in which it has not been "trained" and set up optimally

Related

• Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms
• Enhancing Robustness Against Adversarial Examples in Network Intrusion\n Detection Systems
• Analyzing Root Causes of Intrusion Detection False-Negatives: Methodology and Case Study
• ACTIDS: An Active Strategy For Detecting And Localizing Network Attacks
• Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection