MVPSys Toward practical multi-view based false alarm reduction system in network intrusion detection.pdfVIP

computers security 60 (2016) 177–192 Available online at ScienceDirect journal homepage: /locate/cose MVPSys: Toward practical multi-view based false alarm reduction system in network intrusion detection Wenjuan Li a, Weizhi Meng a,b,*, Xiapu Luo c,d, Lam For Kwok a a Department of Computer Science, City University of Hong Kong, Hong Kong, SAR, China b Infocomm Security Department, Institute for Infocomm Research, Singapore c Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China d PolyU Shenzhen Research Institute, China ARTICLE INFO Article history: Received 9 December 2015 Received in revised form 25 March 2016 Accepted 21 April 2016 Available online 28 April 2016 Keywords: Network security Intrusion detection False alarms Alarm ?lter Multi-view Semi-supervised learning Practical applications ABSTRACT Network intrusion detection systems (NIDSs) have been developed for over twenty years and have been widely deployed in computer networks to detect a variety of network attacks. But one of the major limitations is that these systems would generate a large number of alarms, especially false alarms (positives) during the detection. To address this issue, many machine learning approaches have been applied to reduce NIDS false positives. However, we notice that multi-view based approach is often ignored by the literature, which uses one function to model a particular view and jointly optimizes all the functions to optimize and improve the learning performance. In addition, most existing studies have not implemented their algorithms into practical alam systems. In this paper, we thus develop MVPSys, a practical multi-view based false alarm reduction system to reduce false alarms more ef?ciently, where each view represents a set of features. More speci?cally, we implement a semi-supervised learning algorithm to construct two-view items and automatically exploit both labeled and unlabeled data. That is, this system can automatically extract a