失败成功之母.pptVIP

Incremental Learning System for False Alarm Reduction Preprocess – Feature Construction Asset Information Record the internal device information, including … IP address Operation system Device type Router Computer Server ….. For analysts to record their own assets Snap Shot - Asset Information Feature Extractor Construct the features by extracting the attributes of asset information and alerts information generated by IDS We choice 12 features and 1 label feature 6 alert information Signature name (1) Source and destination IP address (2) Source and destination port (2) Protocol type (1) 6 asset information Intranet or external network in corresponding source or destination IP (2) Operation system in corresponding source or destination IP if it can be known (2) Operation System in corresponding source IP if it can be known (2) Features Analysis in DARPA 1999 alerts Using information gain to rank the ability of discriminating Ranked attributes: 0.79092 1 sig_name 0.78711 2 ip_src 0.77314 5 layer4_sport 0.73 6 layer4_dport 0.57678 3 ip_dst 0.44365 4 ip_proto 0.30369 11 dst_os 0.01934 8 src_os 0.01922 9 src_devtype 0.01909 7 src_intranet 0.00538 12 dst_devtype 0.00538 10 dst_intranet Selected attributes: 1,2,5,6,3,4,11,8,9,7,12,10 : 12 Summary Clearly, we can find source IP has a good score. It represents that black list may give a good effort for discrimination. The destination OS has a good score in all of the extra asset information. That might represents attacker usually focus on specific OS to inject specific attack if they know the target host information. Statistic model should have not bad result according to some features have high capability of discrimination Future work Active scan the internal device Nessus Outgoing traffic analysis Extend more features Incremental Learning Engine Incremental strategy for conquering concept drift Preliminary Incremental Ensemble Algorithm Incremental Learning (Inspired by [6,7,8]) Inc