Alert Log Reduction

Abstract

One of the major issue of Intrusion Detection Systems (IDS) is the high rate of false alerts that the IDS generates. False alerts are the alerts which pretend to be the true alerts. False positives are critical problems of intrusion detection systems that use dif- ferent techniques to detect network intrusions. The techniques or algorithms which are used in intrusion detection systems are unable to eliminate false alerts with short lifes- pan. Secondly, Intrusion Detection Systems (IDSs) can easily generate tons of alerts per day and from them up to 99% of alerts are false positives (i.e. alerts that are triggered incorrectly). This makes it extremely di cult for network administrators to analyze and react to attacks. To overcome this problem a new algorithm is used for handling IDS alerts more efficiently.