Reducing false negative/false positive of IDS/IPS based on formal definition of attacks

根据正式的攻击定义减少 IDS/IPS 的误报/误报

• 批准号: 17500032
• 负责人: IMAIZUMI Takashi
• 金额: $ 2.37万
• 依托单位: Chiba University
• 依托单位国家: 日本
• 项目类别: Grant-in-Aid for Scientific Research (C)
• 财政年份: 2005
• 资助国家: 日本
• 起止时间: 2005 至 2007
• 项目状态: 已结题
• 来源: https://kaken.nii.ac.jp/grant/KAKENHI-PROJECT-17500032/
• 关键词: Internet Security; Intrusion Detection; Prevention System; IDS; IPS; 誤検知; False Positive q; 侵入検知システム; 侵入遮断システム; False Positive

It is important far Intrusion Detection/Prevention Systems to reduce false alerts. If the system makes alerts for ordinary activities, administrators must check the existence of actual intrusions. We found that the differences of recognition among producer of IDS and user of IDS make these false alerts. We researched on how to represent threats that the users consider to be reported.The users of the system consider alerts as false alerts when the detection result is different from the one expected. They judge it according to their own vague senses. It is very difficult to express such a vague demand strictly using description languages similar to programming languages. We found that the technique of the requirements analysis in software engineering is useful to express a vague demand. We define the notation of threats using the technique found in software engineering area. We use post conditions to describe threats, so we can' t use this for IDS/IPS configurations. However, we can evaluate IDS systems by comparing ratios of false alerts.

减少虚假警报是重要的入侵检测/预防系统。如果系统对普通活动发出警报，则管理员必须检查实际入侵的存在。我们发现，ID和ID用户的识别者之间的识别差异使这些虚假警报。我们研究了如何表示用户认为报告的威胁。系统用户将警报视为错误警报，当检测结果与预期的结果不同时。他们根据自己的模糊感官来判断它。使用与编程语言类似的描述语言严格表达出如此模糊的需求是非常困难的。我们发现，软件工程中需求分析的技术对于表达模糊需求很有用。我们使用软件工程区域中的技术来定义威胁的符号。我们使用帖子条件来描述威胁，因此我们可以将其用于IDS/IPS配置。但是，我们可以通过比较错误警报的比率来评估IDS系统。

项目成果

IDSの誤検知除去に対するソフトウェア工学的アプローチ

IDS 误报消除的软件工程方法

• 发表时间: 2007
• 作者: 淡路 淳・今泉 貴史