A Fusion Framework of IDS Alerts and Darknet Traffic for Effective Incident Monitoring and Response

Authors

Sang-Soo Choi, Korea Institute of Science and Technology Information, Daejeon, KoreaFollow
Seok-Hun Kim, Department of Electronic Commerce, Paichai University, Daejeon, KoreaFollow
Hark-Soo Park, Korea Institute of Science and Technology Information, Daejeon, KoreaFollow

Author Country (or Countries)

Korea

Abstract

Most organizations deploy and operate intrusion detection systems (IDSs) in order to cope with cyber attacks. However, in many cases, it is very difficult to not only analyze IDS alerts in real-time, but also identify real cyber attacks with a high detection accuracy because IDSs record the tremendous amount of alerts and most of them are false positives. Many approaches have been proposed to solve this issue, but there is a limitation in that they have focused on dealing with only IDS alerts. Therefore, in this paper, we propose a fusion framework of IDS alerts and darknet traffic, which is aiming at improving the effectiveness of the incident monitoring and response process. The experimental results show that the proposed framework could detect real cyber attacks that were not detected by IDSs and to identify more dangerous IDS alerts related to real cyber attacks.

Digital Object Identifier (DOI)

http://dx.doi.org/10.18576/amis/110209

Recommended Citation

Choi, Sang-Soo; Kim, Seok-Hun; and Park, Hark-Soo (2017) "A Fusion Framework of IDS Alerts and Darknet Traffic for Effective Incident Monitoring and Response," Applied Mathematics & Information Sciences: Vol. 11: Iss. 2, Article 9.
DOI: http://dx.doi.org/10.18576/amis/110209
Available at: https://digitalcommons.aaru.edu.jo/amis/vol11/iss2/9