Dealing with False Positives in Intrusion Detection

Many of today's Intrusion Detection Systems (IDSs) suffer from high rates of false positives [1]. False positives are a severe problem because investigating them takes time and energy. Even worse, if the load of false positives is too high, security personnel might become negligent and start to ignore alarms. Improving this situation is difficult [1, 2]. One possible solution is to use highly specialized IDSs [3, 4] that excel at detecting one narrow class of intrusions and rely upon other IDSs for detecting what is out of their scope. Even though this is probably the way to go in the long run, for the time being, the necessary IDSs as well as the infrastructure to manage them are still in their infancy. Therefore, it has been suggested to build filters that autonomously remove false positives to relieve the security personnel [5]. This is the approach I will discuss in my talk. Note that a filter can be considered a second-level IDS. Accordingly, there are two fundamental ways to build a filter: Either one uses knowledge about how to detect noteworthy alarms (knowledge-based approach), or one models the normal alarm behavior and flags everything that stands out from the norm (behavior-based approach). S. Manganaris et al. have used the second approach to build a filter [5]. I will present a hybrid approach. The rationale for a hybrid approach stems from first experiments I have conducted on nearly 40 MB of NetRanger [6] alarm data collected from five different sensors over a period of ten days. As a general rule, I observed that the five most frequent alarms account for approximately 95% of all the alarms a given NetRanger sensor triggers. Modeling such alarm behavior is difficult because all the important characteristics of normal alarm behavior get lost in a flood of highly dominant and repetitive alarms. Thus, it is unlikely that the behavior-based approach to filtering is adequate for this kind of alarm streams. To solve this problem, I apply a knowledge-based pre-filter that handles the most frequent alarms. As NetRanger alarms contain the context in which they were triggered, it is frequently possible to exploit this context to identify false alarms. Furthermore, external information such as the system administrator's knowledge of the network can provide helpful guidance for building filters. Nevertheless, building a knowledge-based filter is a labor-intensive knowledgeengineering task. Fortunately, this only has to be done for the most frequent alarms. Indeed, using a knowledge-based pre-filter results in a much smaller alarm stream, which is suited for post-processing by a behavior-based filter. To make this filter as effective as possible, it proved to be advantageous not to model the alarm stream per se. Instead, different views of the alarm stream are modeled separately. A view rearranges the alarm stream in order to emphasize one particular aspect, such as which alarms were triggered for which IP connection. With respect to modeling, I currently investigate several models in terms of their ability to capture the alarm patterns that a given view reveals. Frequent episode rules [7] turned out to be a very versatile model, but other models are also under investigation. Specifically, my talk will start off by giving examples of knowledge-based filters. Next, the views and models will be discussed that proved to be most effective for building behavior-based filters. Thereupon, it will be address how well hybrid filters work for NetRanger and other IDSs. The talk will be concluded by a discussion of the extent to which filters are site-specific and how frequently they have to be adjusted to changes in the computing environment.