ATLANTIDES: an architecture for alert verification in network intrusion detection systems

Abstract

We present an architecture 1 designed for alert verification (i.e., to reduce false positives) in network\nintrusion-detection systems. Our technique is based on a systematic (and automatic) anomaly-based\nanalysis of the system output, which provides useful context information regarding the network\nservices. The false positives raised by the NIDS analyzing the incoming traffic (which can be either\nsignature- or anomaly-based) are reduced by correlating them with the output anomalies. We designed our architecture for TCP-based network services which have a client/server architecture (such as HTTP). Benchmarks show a substantial reduction of false positives between 50% and 100%.\n1This research is supported by the research program Sentinels\n(http://www.sentinels.nl). The work of the second author\nwas partially funded by the IST FP6 GridTrust project,\ncontract No. 033827. Part of this work was carried out during\nthe third author’s stay at the University of Trento, supported\nby the GU-IST project Serenity.