Semi-supervised learning for false alarm reduction

Chien Yi Chiu*, Yuh-Jye Lee, Chien Chung Chang, Wen Yang Luo, Hsiu Chuan Huang

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

33 Scopus citations

Abstract

Intrusion Detection Systems (IDSs) which have been deployed in computer networks to detect a wide variety of attacks are suffering how to manage of a large number of triggered alerts. Thus, reducing false alarms efficiently has become the most important issue in IDS. In this paper, we introduce the semi-supervised learning mechanism to build an alert filter, which will reduce up to 85% false alarms and still keep a high detection rate. In our semi-supervised learning approach, we only need a very small amount of label information. This will save a huge security officer's effort and make the alert filter be more practical for the real systems. Numerical comparison with conventional supervised learning approach with the same small portion labeled data, our method has significantly superior detection rate as well as in the false alarm reduction rate.

Original languageEnglish
Title of host publicationAdvances in Data Mining
Subtitle of host publicationApplications and Theoretical Aspects - 10th Industrial Conference, ICDM 2010, Proceedings
Pages595-605
Number of pages11
DOIs
StatePublished - 2010
Event10th Industrial Conference on Advances in Data Mining, ICDM 2010 - Berlin, Germany
Duration: 12 Jul 201014 Jul 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6171 LNAI
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference10th Industrial Conference on Advances in Data Mining, ICDM 2010
Country/TerritoryGermany
CityBerlin
Period12/07/1014/07/10

Keywords

  • False Alarm Reduction
  • Intrusion Detection
  • Machine Learning
  • Semi-Supervised Learning

Fingerprint

Dive into the research topics of 'Semi-supervised learning for false alarm reduction'. Together they form a unique fingerprint.

Cite this