An Approach to Filter False Positive Alerts Based on RS-SVM Theory
Xiao Yun①②; Han Chong-zhao①; Zheng Qing-hua①; Zhao ting①
①School of Electronic & Information Engineering, Xi’an Jiaotong University, Xi’an 710049, China;②School of Information Science and Technology, Northwest University, Xi’an 710127, China
Abstract：To filter false positive alerts generated by Intrusion Detection Systems (IDS), 19 related attributes for distinguishing false positive alerts from true alerts are summarized according to the root and timeliness of intrusion alerts, and an approach to filter these false positive alerts based on RS-SVM (Rough Set and Support Vector Machine) theory is proposed. First, redundant attributes are removed and 10 attributes are obtained utilizing rough set theory in the proposed approach. Then the problem of filtering false positive alerts on the dataset with those 10 attributes is transformed to classification problem, and the classifier is constructed using support vector machine theory. The experimental data is the alert dataset raised by Snort, a network intrusion detection system, monitoring the Defense Advanced Research Projects Agency 1999 intrusion evaluation data (DARPA99). The experimental results show that the proposed approach can reduce about 98% false positive alerts at the cost of increasing about 1.6% false negative alerts. The results of this method are better than those of the other methods that adopt the same dataset and same IDS reported in the literature.
2007, Vol. 29 
