Most organizations deploy and operate intrusion detection systems (IDSs) in order to cope with cyber attacks. However, in many cases, it is very difﬁcult to not only analyze IDS alerts in real-time, but also identify real cyber attacks with a high detection accuracy because IDSs record the tremendous amount of alerts and most of them are false positives. Many approaches have been proposed to solve this issue, but there is a limitation in that they have focused on dealing with only IDS alerts. Therefore, in this paper, we propose a fusion framework of IDS alerts and darknet trafﬁc, which is aiming at improving the effectiveness of the incident monitoring and response process. The experimental results show that the proposed framework could detect real cyber attacks that were not detected by IDSs and to identify more dangerous IDS alerts related to real cyber attacks.
Digital Object Identifier (DOI)
Choi, Sang-Soo; Kim, Seok-Hun; and Park, Hark-Soo
"A Fusion Framework of IDS Alerts and Darknet Trafﬁc for Effective Incident Monitoring and Response,"
Applied Mathematics & Information Sciences: Vol. 11:
2, Article 9.
Available at: https://digitalcommons.aaru.edu.jo/amis/vol11/iss2/9