论文标题
ESNETWORK警报的自动误报过滤
Automated False Positive Filtering for esNetwork Alerts
论文作者
论文摘要
入侵检测系统（IDS）是可以自动分析网络流量并检测可疑活动的安全工具之一。它们被广泛实施为各种业务网络中的安全保证工具。但是，高阳性警报的高率为安全分析师筛选出大量的不必要的警报。 ESNETWORK是Esentire Inc.的IDS产品。该项目着重于在随机森林（RF）分类器的帮助下减少ESNETWORK生成的假阳性警报。 RF模型的构建是为了将警报分类为高和低，并且仅将高可能性警报传递给分析师。作为评估实验的结果，该模型可以实现97％的培训验证验证精度，用于使用最新数据的测试为88％，而在安全操作中心（SOC）审查的事件中，该模型的准确性为58％。提出的模型的评估结果是中间的，因为培训的清晰标记数据以及经过SOC评估的事件的评估不足。该模型仍然需要时间进行微调以满足行业部署要求。
An Intrusion Detection System (IDS) is one of the security tools that can automatically analyze network traffic and detect suspicious activities. They are widely implemented as security guarantee tools in various business networks. However, the high rate of false-positive alerts creates an overwhelming number of unnecessary alerts for security analysts to sift through. The esNetwork is an IDS product by eSentire Inc. This project focuses on reducing the false-positive alerts generated by esNetwork with the help of a Random Forest (RF) classifier. The RF model was built to classify the alerts as high and low and only pass high likelihood alerts to the analysts. As a result of evaluation experiments, this model can achieve an accuracy of 97% for training validation, 88% for testing with the recent data, and 58% with Security Operation Centre (SOC) reviewed events. The evaluation result of the proposed model is intermediate because of the deficiency of clearly labeled data for training as well as the SOC-reviewed events for evaluation. The model still needs time to be fine-tuned to meet the industry deployment requirement.
