00000nam 2200000zi 4500 9.892654 CaOODSP 20221107173230 m o d f cr mn||||||||| 201021s2008 onca ob f000 0 eng d CaOODSP eng rda CaOODSP eng eng fre Co24-3/8-2008-2E-PDF Massicotte, Frederic, author. Automatic generation of intrusion detection verification rules : report on research progress to September 1, 2008 / Frederic Massicotte, Yvan Labiche and Lionel C. Briand. Ottawa : Communication Research Centre Canada = Centre des recherches sur les communications Canada, 2008. 1 online resource (iii, 14 pages) : illustrations. text txt rdacontent computer c rdamedia online resource cr rdacarrier CRC note ; VPNT2008/02 "Ottawa, September 2008." Digitized edition from print [produced by Innovation, Science and Economic Development Canada]. Includes bibliographical references (pages 13-14). "An Intrusion Detection System (IDS) is a crucial element of a network security posture. One class of IDS, called signature-based network IDSs, monitors network traffic, looking for evidence of malicious behavior as specified in attack descriptions (referred to as signatures). Many studies have reported that IDSs can generate thousands of alarms a day, many of which are false alarms. The problem often lies in the low accuracy of IDS signatures. It is therefore important to have more accurate signatures in order to reduce the number of false alarms. One part of the false alarm problem is the inability of IDSs to verify attacks (i.e. distinguish between successful and failed attacks). If IDSs were able to accurately verify attacks, this would reduce the number of false alarms a network administrator has to investigate. In this note, we demonstrate the feasibility of using a data mining algorithm to automatically generate IDS verification rules. We show that this automated approach is effective in reducing the number of false alarms when compared to other widely used and maintained IDSs"--Abstract, page ii. Issued also in print format. Includes abstracts in English and French. Intrusion detection systems (Computer security) Systèmes de détection d'intrusion (Sécurité informatique) Communications Research Centre (Canada), issuing body. CRC technical note ; no. 2008/02. (CaOODSP)9.882494 PDF 1.54 MB https://publications.gc.ca/collections/collection_2020/isde-ised/Co24/Co24-3-8-2008-2-eng.pdf